TL;DR - A four-year, $750K Hyperliquid trading wallet was banned in March 2026 after an unsolicited two-cent address-poisoning transfer triggered a false high-risk flag.
Your wallet can trade for four years, move three-quarters of a million dollars, and never touch a sanctioned address, and still get locked out over a transfer you never asked for and had no way to refuse. That's what happened to a Hyperliquid trader in March 2026, and it shows what a screening tool can do when it can't tell a listed sender from an innocent recipient.
Why did a 2-cent transfer get a $750,000 wallet banned from Hyperliquid?
On March 6, 2026, a trader known publicly as Maxime received an unsolicited transfer of 0.000001 ETH, worth about two cents, from the address 0xAB55337Aab7f253aC6923ec2aA8C702754D08151. His wallet was four years old, had processed more than 9,000 transactions across multiple chains, and had done roughly $750,000 in trading volume on Hyperliquid alone. None of that mattered on March 29. The platform's frontend banned the address outright, flagged as high risk by a third-party screening tool.
The trigger wasn't anything Maxime did. Some analytics system had tagged the sending address with an alleged link to child sexual abuse material, and that tag rode along with the two-cent transfer straight into his wallet's risk profile. He hadn't chosen to receive the funds, hadn't spent them, and couldn't have refused the transfer before it landed. A public address can't turn away an incoming payment. It can only decide what happens after.
Three weeks passed between the two-cent transfer and the ban, and two more days before the platform called it a false positive.
What is address poisoning, and why did it fool the screening tool?
Address poisoning is usually described as a scam that tricks a victim into copying a lookalike address from their own transaction history. The mechanism behind Maxime's ban works the same way but for a different purpose. An address some system had already linked to a specific list sent a trace amount of ETH, and that contact alone was enough for the recipient's wallet to inherit the tag. The goal wasn't theft. It was contamination by association.
A wallet history four years long, with 9,000-plus transactions and no prior flags, should count for something in that calculation. It didn't. The screening tool treated one inbound, cent-scale transfer the same way it would treat a direct deposit from a sanctioned entity, with no weighting for direction, size, or the fact that the recipient never solicited it. Hyperliquid's own team eventually called the ban a false positive from an address-poisoning transfer, the same mechanics covered in how address poisoning works, just aimed at a risk score instead of a victim's clipboard.
Can a wallet screening tool flag you for someone else's transaction?
Yes, and that's the part most users don't expect. Sanctions and stolen-funds screening exists to catch a wallet that received funds from a listed source and then did something with them: cashed out, moved them along, mixed them. A pure receive-and-hold event, at one hop and two cents, is a different category of risk entirely, and a tool that can't tell the difference will ban a clean wallet exactly like it banned Maxime's.
The design of the underlying corpus matters more here than any marketing claim. Plastron's own labelled corpus tracks 3,901 known-bad addresses sorted by category, plus the full OFAC sanctions list of 780 entries, and a direct hit against either produces a specific verdict: this address, this list, this reason. A one-hop, $0.02 inbound transfer from an address carrying a disputed tag is not the same finding as a direct match, and a screening result that can't say which one happened is not a risk score. It's a guess dressed as a verdict.
Same $0.02 transfer, same one hop, two different verdicts, depending on whether the tool checks a named list or scores a vibe.
You can check a suspicious sender by hand on a block explorer such as Etherscan, paging through its history one transaction at a time. Screen the address with Plastron instead, and see sanctions, mixer, and stolen-funds exposure across Ethereum and six other chains in seconds, before you assume the worst about an incoming transfer or ignore a flag you should have taken seriously.
How do you protect a wallet from a false-positive ban like this?
Don't spend or move an unsolicited dust transfer. Treat it as a hazard, not a bonus, and leave it sitting untouched so it can't combine with funds you actually control.
Three habits limit the damage from here:
Never spend an unsolicited dust transfer; leave it isolated in the wallet rather than combining it with other funds.
Screen your own address before and after large trades, not only the counterparty's, so a bad tag surfaces on your terms.
Keep wallet age, transaction count, and trading volume documented so a dispute with a platform takes minutes, not weeks.
Records are what actually moved Maxime's case. Hyperliquid's team confirmed the false positive on April 1, three weeks after the transfer and three days after the ban, once the wallet's four-year history and $750,000 volume were laid out plainly against a two-cent transaction and a tag it never asked to carry. The same discipline that protects an OTC desk before a trade, covered in how to dispute a false-positive flag, is what gets a self-custody wallet unbanned after the fact.
FAQ
Was Maxime's Hyperliquid wallet actually involved in anything illegal?
No. The wallet had four years of history, more than 9,000 transactions, and about $750,000 in trading volume with no prior flags. Hyperliquid's team called the ban a false positive from an address-poisoning transfer, not a confirmed link to wrongdoing.
What is a dust or address-poisoning transfer?
It's an unsolicited transfer, sometimes worth a fraction of a cent, sent to a wallet without the recipient's request. In Maxime's case the sending address itself carried a disputed risk tag, and that tag spread to his wallet the moment the transfer landed.
Can I refuse an incoming crypto transfer before it reaches my wallet?
No. Any address can send funds to a public wallet address without permission. You can only decide what happens after it arrives: don't spend it, and screen it if the sender looks unfamiliar.
How do I check whether an address that sent me funds is flagged?
Run the address through a wallet screening tool that checks sanctions lists and known-bad-address corpora directly, rather than one that scores behavior alone. A direct-list match gives you a specific reason. An opaque high-risk label doesn't.
Disclaimer: This article is for educational and informational purposes only and is not legal, financial, tax, or compliance advice. Crypto carries risk; you act on this information at your own risk. Always do your own research and consult a qualified professional before making decisions. Views are the author's own and do not constitute financial, legal, or investment advice.
About Plastron
Plastron is a free, non-custodial wallet screening tool. It checks Ethereum and six EVM chains for AML and KYT risk — sanctions exposure, mixer contact, and stolen-funds proximity — and returns a risk report in seconds. It reads public on-chain data only: it never takes custody of funds and never asks for private keys.
