One of the oldest Ethereum wallets, which received its first ETH back during the network's launch in 2015, has emerged from years of dormancy — and immediately became the target of a coordinated attack by malicious actors. The address owner transferred 2,154.94 ETH (about $4.6 million) after 11 years of complete inactivity.
The attack scenario turned out to be a classic example of blockchain social engineering. Just three minutes after a test transfer of 0.05 ETH, the scammers activated a so-called "address poisoning" attack — sending micro-payments from addresses visually indistinguishable from the recipient's address. The calculation was based on the owner copying the details from the transaction history and sending the funds to the wrong place.
One of the attacker addresses made 43 micro-payments in a row, seeking to establish itself in the victim wallet's transaction history and increase the chances of an error during copying. However, the owner did not fall for the trick: after carefully verifying the details, he successfully moved the full amount to a safe address 38 minutes later.
The incident demonstrates how dangerous "dormant" wallets from Ethereum's early eras remain: any movement on them instantly attracts the attention of bots and malicious actors tracking large and historical addresses in real time. Address poisoning has become one of the most common attack vectors, since it does not require hacking private keys — just one moment of carelessness when copying an address is enough.
Cryptalist analysis: The case confirms that institutional and large holders need to implement multi-level address verification and use hardware wallets with details verified on the device screen. The growing activity around old addresses points to the systemic nature of the threat: malicious actors specifically monitor historical wallets, which means any transaction from them requires maximum operational discipline.