A wallet created at Ethereum’s inception moved roughly 2,155 ETH—valued at about $4.6 million—after more than a decade of inactivity, while evading an address‑poisoning scam that surfaced minutes after the first test transaction, according to blockchain monitoring services.

ETH / USD
Source: CoinGecko. Prices are indicative.

Background of the dormant address

The address, identified by the prefix 0x7dDd, first received Ether in the network’s genesis block in July 2015 and a second deposit of 755 ETH in March 2016. No outgoing transfers were recorded until the recent activity on November 9, 2026, when the wallet sent a 0.05 ETH test payment at roughly 22:04 UTC, valued at about $106.

Rapid scam response and address‑poisoning attempt

Within three minutes of the test payment, two suspicious accounts began sending a series of tiny ETH transfers that mimicked the legitimate destination address. The look‑alike addresses, flagged by Etherscan as linked to phishing activity, generated 43 micro‑transactions in an effort to confuse the sender—a technique known as address poisoning. Whale Alert highlighted the activity, noting that the fraudulent addresses copied the final characters of the intended recipient.

The scam operators reacted quickly, aiming to intercept the larger transfer that the wallet was about to execute.

Successful large transfer and security implications

At approximately 22:42 UTC, the wallet completed a 2,154.94 ETH transfer—worth about $4.6 million—to the intended address, with the funds bypassing the malicious accounts. The owner appears to have used the initial 0.05 ETH transaction as a verification step, then proceeded with the main transfer after confirming the destination.

The episode underscores how automated monitoring can expose high‑value wallets to address‑poisoning attacks, and why a single test transaction is insufficient protection. Experts advise multiple verification layers, such as confirming full addresses off‑chain and using hardware wallets, especially when moving large sums.

What to watch next

Analysts will monitor whether the moved ETH is sold on exchanges or redeployed in decentralized finance protocols, and whether similar dormant pre‑mine wallets become active. Additionally, the incident may prompt wallet developers to enhance UI cues that reduce the risk of copying truncated addresses.