Ethereum Network Activity Explodes - But Researchers Warn It’s Fueled by Address Poisoning Attacks

Ethereum's blockchain is buzzing with more transactions than a Wall Street trading floor on margin call day. But that surge in activity isn't all bullish DeFi action or NFT mints. A growing portion, researchers now warn, is malicious noise designed to trick users.

The Phantom Surge

On-chain analysts are pointing to a sharp rise in 'address poisoning' attacks as a key driver behind recent network congestion. The scam is simple yet effective: flood a target's transaction history with fake transfers to similar-looking wallet addresses. The goal? Create confusion, hoping someone copies the wrong address for their next genuine transaction—sending funds straight to a scammer.

How the Poison Spreads

Attackers exploit a common user behavior—copy-pasting addresses from past transactions. By spending trivial amounts of gas to send dust to a target from a spoofed address, they pollute the history. One wrong click, and your six-figure transfer is gone, bypassing all of crypto's so-called 'unhackable' security. It's the digital equivalent of swapping out a billionaire's bank details with a lookalike account number and hoping their accountant has a bad day.

The Cost of Doing Business (For Scammers)

This isn't sophisticated code exploitation; it's a psychological play that leverages human error. The activity inflates transaction metrics, making the network look busier than it truly is—a cynical parallel to traditional finance where trading volume can be pumped by high-frequency wash trades. The real volume? Just another phantom in the machine.

So, the next time you see a chart spiking for Ethereum network activity, remember: not all that glitters is gold. Sometimes, it's just the flash of fool's gold being minted by the block.

Ethereum Activity Spike May Be Driven by Address Poisoning

While the surge initially appeared to signal organic growth, Sergeenkov cautioned that part of the increase could be attributed to large-scale spam campaigns known as address poisoning.

These attacks exploit low fees by flooding the network with small transactions designed to trick users rather than facilitate legitimate activity.

Address poisoning works by sending tiny transfers from wallet addresses that closely resemble legitimate ones.

When users later copy an address from their transaction history, they may unknowingly send funds to the attacker instead.

Something extraordinary happened on @Ethereum last week.

On Friday, January 16, #Ethereum mainnet hit 2.9M #transactions in a single day (see Chart 1) — a new all-time high per @Etherscan. That activity was accompanied by a sharp jump in daily active addresses: ~1.3M (Chart 2),… pic.twitter.com/8EvKFymfWV

The tactic has grown more economical since Ethereum’s Fusaka upgrade in December, which cut network fees by more than 60% in the following weeks.

“Address poisoning has become disproportionately attractive for attackers,” Sergeenkov said, adding that scaling blockchain infrastructure without prioritizing user safety risks distorting headline activity metrics.

To track the attacks, Sergeenkov analyzed wallets that received less than $1 as their first stablecoin transaction, identifying clusters of so-called “dust distributor” addresses.

He then filtered for those that had sent transactions to more than 10,000 recipients, a pattern consistent with poisoning campaigns.

Some of the most active distributor wallets sent dust to more than 400,000 addresses, he said. So far, more than $740,000 has been stolen from at least 116 victims using this method.

The findings highlight a tension emerging from Ethereum’s improved efficiency. Lower fees have made the network more accessible for users and developers, but they have also reduced the cost of abuse.

Sergeenkov said the episode underscores the need for better wallet-level protections and clearer user warnings, arguing that raw transaction growth alone is not a reliable measure of healthy network adoption.

Buterin Says Ethereum Is Entering a New Phase Focused on User Autonomy

Ethereum co-founder Vitalik Buterin has framed the moment as more than a technical milestone.

In a recent post, he said the community is entering a phase focused on restoring personal autonomy and improving user experience, arguing that earlier compromises made in pursuit of adoption no longer need to define the network’s future.

“2026 is the year that we take back lost ground in terms of self-sovereignty and trustlessness,” Buterin said in an X post.

Together, record activity, falling fees, and rising participation suggest Ethereum is entering a new phase, one where scale no longer comes at the expense of accessibility.