What happened on May 3, 2024
Block explorer Blockscout’s record for one Ethereum address, beginning 0x1E22, shows how quickly the trap can close. At 09:14:47 UTC on May 3, 2024, it sent 0.05 ETH to an address starting 0xd9A1b0B1 and ending 2853a91.
Just 168 seconds later, a token contract calling itself “Ether” logged a 0.05 transfer from the same sender to 0xd9A1C378…4853a91, an address that shares its first four characters after “0x” and its last six with the one just paid. Even the amount matched.
At 10:31:35 UTC the address sent 1,155.28802767 WBTC, a token that tracks bitcoin, to the lookalike. Bitcoin traded between $58,854 and $59,491 in that hour on exchange Coinbase’s market data, which puts the transfer at about $68 million.
The history kept filling. On May 8 another fake token, its ticker spelled with two Cyrillic letters that pass for “B” and “T”, copied the exact 1,155.28802767 amount.
How the decoy gets into your history
Wallet maker MetaMask explains the method on its support site. The scammer’s software watches transfers of certain tokens, usually stablecoins, then a vanity generator produces an address that closely matches yours or a contact’s, and a transfer of negligible value from it lands in your list. Most people read only the ends.
Why can a fake transfer appear to come from you? On Ethereum-style chains, wallet maker Trezor says in its support article, a token can be moved “from” an address without its owner’s approval as long as the allowance isn’t exceeded, so a zero-value transfer can still show up as sent by you. Networks with low fees, such as Polygon, are often targeted, Trezor adds.
Where the warnings appear
MetaMask now compares each destination with your history and warns before sending when, for example, the first four and last four characters match but the middle differs. Trezor Suite blurs transfers that look like poisoning and marks them unverified. Both makers say not to copy addresses from history, your own included when moving funds from an exchange into a self-custody wallet.
Trezor also suggests a small test payment before a large one. A test proves less than it seems.
On May 3, 2024, the fake copied the 0.05 ETH payment within three minutes, so a test only helps if the real transfer is then pasted from a saved contact or another verified source, not from the list that by then holds the decoy.