An Ethereum wallet dating to the network's 2015 launch made its first outgoing transfer on Monday, and scammers targeted it within three minutes of a small test payment. The owner avoided the trap and sent about $4.6 million in ether to the intended address.
An Ethereum wallet from the network's 2015 launch sent money for the first time late Monday, and scammers moved in within minutes. The owner still delivered the funds to the right address.
A dormant wallet makes a test payment
The wallet got its first ether in the genesis block in July 2015 and took in another 755 ETH in March 2016. It had never sent anything out until Monday.
At 22:04 UTC, it made a 0.05 ETH test payment, worth about $106, to a new address starting 0x1321beb8 and ending 1A44. Blockchain tracker Whale Alert flagged the move.
Lookalike addresses flood the history
Within three minutes, the old wallet began receiving tiny transfers of ether from two addresses built to resemble the one the owner had just paid. Etherscan shows both were funded by accounts it tags as "Fake_Phishing," and the busier one sent 43 of these dust payments.
The tactic is called address poisoning. Wallet apps usually show only the first and last few characters of an address, so a scammer creates a lookalike and drops dust into the target's transaction history. If the owner copies the "recent recipient" from that history, the funds go to the scammer.
Bots watch the chain around the clock for large, long-dormant wallets, and a test transfer from one can be taken as a signal of a bigger payment probably coming, CoinDesk reported.
The owner sends the funds to the right address
The owner took a second precaution. At 22:20 UTC, the new wallet sent 0.01 ETH onward, and nearly all of it came back three minutes later.
Then, at 22:42 UTC, 38 minutes after the first test, the old wallet sent 2,154.94 ETH, roughly $4.6 million, to the correct 0x1321beb8 address.
Address poisoning has turned into a volume business on Ethereum. In January, Citi warned that poisoning spam was inflating the network's record transaction counts.
Source: CoinDesk
Trading involves risk.