Adedayo Oreoluwakitan built a fake wallet with fake money and waited to see if someone would try to steal it.
The wallet had nothing in it worth stealing. No real funds, no real owner, no reason to exist except to be found. So when a transaction hit it at 2:33 p.m. on a Friday and moved a chunk of Sepolia ETH to an address he did not recognise, Oreoluwakitan felt something close to triumph.
That transaction was his.
He had sent it himself, playing the attacker in a controlled test of a trap he had built to see whether it worked. It did. The alert appeared on his dashboard before he had finished refreshing MetaMask.
That is the basic idea behind a honeytoken wallet, and it points to an interesting possibility for crypto security: instead of waiting for an attacker to compromise a valuable wallet, defenders can create something that looks useful, monitor it closely and treat any unexpected interaction as an early warning.
Crypto theft is particularly difficult to deal with because blockchain transactions are designed to be irreversible. Once an attacker gains control of a private key and transfers the assets, there is usually no bank or central fraud department that can simply reverse the transaction. The funds can move through multiple addresses before the victim fully understands what has happened, making investigation and recovery much harder.
That combination of irreversible transactions and delayed detection caught Oreoluwakitan’s attention. Instead of focusing only on how to prevent theft, he wanted to explore how defenders could know when an attacker might have gained access in the first place.
That question pulled him toward an established cybersecurity technique: the honeypot.
A honeypot is a deliberately exposed system designed to attract or detect attackers. A honeytoken uses the same basic principle on a smaller scale. It can be a fake password, API key, document or account that has no legitimate purpose. Because nobody should normally use it, unexpected activity involving the token can become a strong signal that something is wrong.
Oreoluwakitan wanted to see what that logic would look like when applied to a cryptocurrency wallet.
So he generated a decoy Ethereum address using Web3.py and designed it to resemble the kind of wallet an attacker might encounter in a configuration file, a leaked repository or another location containing sensitive information. The wallet holds little or nothing of value. Its main purpose is to sit quietly and be monitored.
He then wrote a Python script to monitor the Sepolia testnet for activity involving the address. The system checks new blockchain activity and looks for transactions that involve the monitored wallet. When it detects one, it records the event and generates an alert.
The important part is that the wallet is not supposed to have legitimate activity.
A normal cryptocurrency wallet can send and receive funds for many valid reasons. That makes conventional monitoring more complicated because a security system has to determine whether a transaction is unusual enough to investigate.
The decoy wallet has a much simpler rule: it should not be touched.
If someone suddenly interacts with it, that activity deserves attention.
Oreoluwakitan tested the system on Sepolia rather than Ethereum mainnet, using test ETH to simulate transactions. He created a scenario in which the private key associated with the decoy wallet was deliberately exposed and then used to initiate a transaction.
The monitor detected the simulated activity after the relevant blockchain event was observed and generated an alert through the dashboard. In the test environment, this happened within the time required for the relevant block to be detected and processed.
The result was encouraging because the system did not have to guess whether the transaction looked suspicious. The nature of the wallet provided the context.
There was no normal payment to analyse, no regular user activity to distinguish from malicious behaviour and no legitimate reason for the wallet to suddenly move funds. Any unexpected interaction was therefore a strong reason to investigate.
“If they take the bait of a honeytoken, they unwittingly announce their presence,” Oreoluwakitan wrote in his report.
The approach is not perfect, however.
Its biggest limitation is that an attacker has to find and interact with the decoy. If someone compromises a real wallet without ever discovering or touching the honeytoken, the system remains silent while the theft happens elsewhere.
The system also only monitors the blockchain networks and addresses for which it has been configured. Monitoring Ethereum, BNB Chain and Solana simultaneously, for example, would require additional network-specific monitoring and infrastructure.
For now, the system is designed to alert rather than automatically respond. It does not freeze an account, recover stolen assets or move real funds to safety. Those actions would require additional security and incident-response systems.
There are also challenges involved in moving from a controlled testnet environment to a production deployment. A real-world system would need to handle larger volumes of blockchain activity, maintain reliable monitoring, store security events securely and deliver alerts quickly enough for someone to investigate them.
The system could also be expanded. WebSocket subscriptions could replace regular polling to improve how quickly blockchain events are received. Email or messaging alerts could make notifications more useful than relying only on a dashboard. A database such as SQLite or PostgreSQL could provide more reliable storage as the number of monitored wallets grows.
The monitoring could eventually cover more than ordinary wallet transfers. Smart-contract interactions and other on-chain activity could provide additional signals when investigating compromised credentials.
The same principle could also be adapted to other blockchain networks, although each network would require its own monitoring logic and infrastructure.
What makes the approach interesting is its simplicity.
Traditional fraud detection often looks for unusual behaviour: a large transfer, an unfamiliar destination, an unusual time of day or a sudden change in spending patterns. Those systems can be powerful, but legitimate activity can sometimes look suspicious too.
A honeytoken starts with a different assumption.
The wallet should not be used.
That makes an unexpected interaction meaningful from the moment it happens.
The technique does not replace hardware wallets, multisignature security, private-key protection or basic operational discipline. It also cannot guarantee that a real wallet compromise will be detected.
But it can provide another layer of visibility, particularly when an attacker obtains credentials that were never supposed to be exposed.
The idea is simple: give an attacker something they can touch without putting real assets at risk, then make sure that touch does not go unnoticed.
Sometimes the smartest security trap is not the one that stops someone from breaking in. It is the one that makes sure they cannot do it quietly.
Adedayo Oreoluwakitan Osaruonamen is a technology professional, software developer, cybersecurity specialist and technology entrepreneur with expertise spanning software engineering, cybersecurity, ethical hacking and digital product development. He is the Co-Founder and Lead Software Developer at Avantizon, a digital marketplace helping local businesses improve their visibility and connect with customers in their communities.
At Avantizon, Adedayo has played a central role in developing the platform from its early architecture into a live marketplace that has grown to more than 1,500 users, 50 verified businesses and over 80 services. His work extends beyond software development to product development, business growth, engaging directly with local business owners to understand their challenges and presenting the technology behind the platform to investors. These experiences have shaped his belief that meaningful technology is not simply about what can be built, but about understanding people and creating solutions they can genuinely use and trust.
His journey into technology began at the age of eleven, when he wrote his first lines of code using Scratch. That early curiosity developed into a passion for building practical solutions and eventually led him to earn a First Class Honours degree in Information Technology from Middlesex University London at the age of seventeen. He also holds an Advanced Diploma in Software Engineering from APTECH Computer Education.
Alongside his entrepreneurial work, Adedayo has built strong expertise in cybersecurity and ethical hacking. As an Ethical Hacker at BOCH Systems West Africa, he gained hands-on experience in penetration testing, vulnerability assessment, network security audits, threat modelling and reconnaissance, using tools including Kali Linux, Metasploit, Burp Suite, Nmap and Nping. His work is grounded in web application security and the OWASP Top 10, with professional certifications including CompTIA Security+ and training in Introduction to Cybersecurity and Networking Basics.
He is also committed to mentorship, having spent several years teaching programming to a younger learner starting, fittingly, with the same platform that first introduced him to coding.
Driven by curiosity and continuous learning, Adedayo is focused on building secure, trustworthy technology that creates meaningful economic opportunities for individuals and small businesses while contributing to a more resilient and innovative digital ecosystem.
