An Ethereum wallet that had been idle since the network's 2015 launch moved $4.6 million this week. The wallet is 11 years old, and its sudden activity drew automated attention almost immediately.
Bots flagged the address as soon as it went active. Within minutes, they planted lookalike addresses in the wallet's transaction history — a setup designed to trick the owner into sending funds to a near-identical string.
The owner sent the money to the correct address anyway. The scam attempt failed.
A race measured in minutes
The mechanics here aren't complicated, which is what makes them worth watching. An old wallet waking up is a public event. Anyone watching the chain sees the incoming transaction, and bots can generate similar-looking addresses and inject them into the visible history before the owner has finished typing the destination.
In this case the lookalikes were in place within minutes of the wallet stirring. That's the window the attackers were working with: the brief stretch between "this address is alive" and "this address is about to send."
Why old wallets draw bots
A wallet dormant since 2015 is a known type of target. The owner is likely working with tools and habits from a different era of Ethereum, and they may not be checking address strings against a known-good list the way a more practiced user would. Bots don't need the owner to be careless — just slow enough for one glance to land on the wrong line.
The lookalike trick depends on exactly that. Addresses are long, the first and last few characters are what people actually read, and a generated address can match both while differing in the middle.
The transfer that went through
The owner got it right. The $4.6 million went to the intended destination, and the planted addresses collected nothing.
That's the outcome, but it's also close to the exception. The setup was live before the transfer was, and the only thing standing between the funds and a lookalike was the owner's own verification.
What's left open
What isn't clear from the available information is whether the wallet owner noticed the lookalikes at all, or simply got the address right without ever seeing them. The answer matters for anyone holding a long-dormant address: the bots are watching those wallets too, and they don't need the owner to make a mistake twice.
