An Ethereum wallet dating to the network’s 2015 launch sent money for the first time late Monday, and within minutes it had company it didn’t ask for.

The address, 0x7dDd57165c87A2707f025DCFC2508c09834759Bc, got its first ether in Ethereum’s genesis block, the very first block of the chain, in July 2015, and took in another 755 $ETH in March 2016. It never sent anything out until Monday, when it made a 0.05 $ETH test payment worth about $106 at 22:04 UTC to a new address starting 0x1321beb8 and ending 1A44. Blockchain tracker Whale Alert flagged the move.

That test is what the scammers were waiting for.

Within three minutes the old wallet started receiving a stream of transfers of tiny amounts of ether. They came from two addresses built to look almost exactly like the one the owner had just paid, one starting 0x13211f and the other 0x1321FB, and both ending in 1A44. Etherscan shows both were funded by accounts it tags as “Fake_Phishing,” and the busier one sent 43 of these dust payments.

How the scam works

The trick is called address poisoning. Wallet apps usually show only the first and last few characters of an address, so a scammer makes a lookalike and drops dust into the target’s transaction history.

If the owner then copies the “recent recipient” from that history to send the real money, the funds go to the scammer. It works best on someone who has just sent a test payment and is about to send everything else, which is exactly where this owner was.

The lookalike addresses were funded within minutes of the test payment, data shows. Bots watch the chain around the clock for large, long-dormant wallets, and a test transfer from one can be taken as a signal of a bigger payment probably coming.

The owner didn’t fall for it in this instance, however, and took a second precaution along the way. At 22:20 UTC the new wallet sent 0.01 $ETH onward, and nearly all of it came back three minutes later.

Then, at 22:42 UTC, 38 minutes after the first test, the old wallet sent 2,154.94 $ETH, roughly $4.6 million, to the correct 0x1321beb8 address, which now holds about 2,155 $ETH.

Address poisoning has turned into a volume business on Ethereum. In January, Citi warned that poisoning spam was inflating the network’s record transaction counts with much of the new activity being transfers worth less than $1 — about the same amount these scammers sprayed at the 2015 wallet.