Is Ethereum's Activity Growth Authentic? Unpacking the 3.86 Million Poisoned Wallets

Ethereum [ETH] has recently recorded some of the highest network activity metrics in its history. However, not everything is as positive as it seems. Security researcher Andrey Sergeenkov suggests that much of this uptick in activity is the result of a widespread address poisoning attack.

Key Takeaways

Ethereum recently saw a substantial increase in activity with 2.7 million new addresses, driven mainly by stablecoin transactions.
Around 80% of the surge in activity came from USDT and USDC.
67% of new addresses received less than $1 in their first transaction, indicating an "address poisoning" scheme.
Attackers use familiar-looking addresses to trick users into sending funds unknowingly to them.
Recent upgrades to Ethereum have made it easier and more economical for attackers to execute these schemes, resulting in significant financial losses for victims.

ethereum

Source: sergeenkov.com
On the surface, the reported data is striking. New Ethereum addresses skyrocketed to 2.7 times the average for 2025, peaking around January 12 with 2.7 million new addresses, marking a 170% increase over typical levels. Concurrently, weekly transactions surged by 63%, rising from 10.5 million to a record 17.1 million.

ethereum

Source: sergeenkov.com
However, when Sergeenkov conducted further analysis, he found that roughly 80% of this growth resulted from stablecoins, particularly USDT and USDC. This is noteworthy since stablecoins are frequently utilized in automated transactions, leading to unusually distorted activity figures.

ethereum

Source: sergeenkov.com
An examination of first-time stablecoin transactions highlights a concerning trend: 67% of new addresses received under $1 as their initial transfer. In total, 3.86 million out of 5.78 million addresses were recipients of these small "dust" payments, a clear indication of an address poisoning attack.

ethereum

Ethereum's network metrics have soared, with a remarkable increase in new addresses and transactions. Nevertheless, a closer examination reveals that a significant portion of this activity stems from automated transactions involving stablecoins. Many of these new addresses received insignificant amounts, suggesting they are victims of address poisoning.

Understanding Address Poisoning

Address poisoning is a tactic where attackers send tiny amounts of tokens to wallets that have addresses similar to a target's real wallet. When individuals later select an address from their transaction history without verifying it, they may unintentionally send funds to the attacker.

ethereum

Source: sergeenkov.com
Sergeenkov tracked USDT and USDC transfers under $1 from December 15 to January 18, 2026, identifying the main perpetrators. He filtered for accounts that sent dust to at least 10,000 unique addresses, revealing several significant operatives. The top three contracts alone sent dust to over 1.6 million addresses, with individual amounts reaching up to 690,000 wallets, 589,000, and 405,000 respectively.

The Impact of the Fusaka Upgrade

Previously, the success rate of address poisoning was very low (approximately 0.01%), which meant attackers needed a few significant errors to profit. However, one victim alone suffered a loss of $509,000, representing the majority of the stolen funds so far. This trend shifted with the Fusaka upgrade in December.

The Fusaka upgrade took average ERC-20 transfer fees down by nearly six times, making it cheaper to send vast numbers of spam transactions. Consequently, large-scale address poisoning attacks became financially rewarding almost overnight.

New contracts have emerged in recent days, with one already distributing dust to 78,000 addresses. Notably, all major attacker contracts remain active, and the largest financial losses tend to accrue as attacks progress.

Concluding Thoughts

The recent surge in Ethereum's activity metrics, while impressive at first glance, is overshadowed by the prevalence of address poisoning schemes targeting unsuspecting users. As the landscape of Ethereum continues to evolve, so does the potential for these malicious tactics, urging users to remain vigilant in ensuring the security of their transactions.