Lookalike Addresses Followed Test Before Early Wallet’s $4.6 Million ETH Transfer

An early Ethereum wallet sent 2,154.94 Ether (ETH), worth roughly $4.6 million, to a recipient it had tested earlier, after transfers from two similar-looking addresses appeared in its transaction history.

The wallet sent 0.05 ETH to the recipient at 5:04 p.m. ET Nov. 9 (22:04 UTC). Within about three minutes, small transfers from two lookalike addresses appeared in the wallet’s history. The recipient and both lookalikes shared the opening 0x1321 and ending 1A44, but differed in between.

The pattern fits address poisoning, a tactic that places a lookalike address in a wallet’s history in the hope it will be copied for a later payment. Wallet interfaces can shorten addresses, making it harder to spot differences. The test payment reached that address, but the later destination still required checking.

At 5:42 p.m. ET (22:42 UTC), the wallet sent 2,154.94 ETH to the same recipient used for the test, not either lookalike. The transfer was valued at roughly $4.6 million. The wallet’s holder, control of the recipient address and awareness of the lookalike transfers have not been established.

Etherscan’s address-poisoning guidance says, “Always verify the destination address before sending funds.” TokenPost previously covered the early wallet’s larger Ether transfer.