If the owner then copies the “recent recipient” from that history to send the real money, the funds go to the scammer. It works best on someone who has just sent a test payment and is about to send everything else, which is exactly where this owner was.
The lookalike addresses were funded within minutes of the test payment, data shows. Bots watch the chain around the clock for large, long-dormant wallets, and a test transfer from one can be taken as a signal of a bigger payment probably coming.
The owner didn’t fall for it in this instance, however, and took a second precaution along the way. At 22:20 UTC the new wallet sent 0.01 $ETH onward, and nearly all of it came back three minutes later.
Then, at 22:42 UTC, 38 minutes after the first test, the old wallet sent 2,154.94 $ETH, roughly $4.6 million, to the correct 0x1321beb8 address, which now holds about 2,155 $ETH.
Address poisoning has turned into a volume business on Ethereum. In January, Citi warned that poisoning spam was inflating the network’s record transaction counts with much of the new activity being transfers worth less than $1 — about the same amount these scammers sprayed at the 2015 wallet.
Leave a Reply