Ethereum Activity Hits Records as Low Fees Fuel Address Poisoning Attacks

Ethereum network activity surged to record levels in January, but security researchers say much of the growth may be driven by spam attacks rather than organic user demand.

Security researcher Andrey Sergeenkov said a sharp rise in active addresses and transactions likely links back to address poisoning, a low cost scam that became easier after Ethereum fees dropped in December.

Ethereum’s active address count nearly doubled to 8 million within one month. Daily transactions climbed to a record of almost 2.9 million.

During the week starting Jan. 12, the network added around 2.7 million new addresses. That figure stands about 170% above normal levels. Daily transaction counts also jumped above 2.5 million during the same period.

Sergeenkov said the timing matches a sharp fall in transaction costs following the Fusaka network upgrade in early December. In the weeks after the upgrade, average network fees dropped by more than 60%.

Lower fees reduced the cost of sending large volumes of small transactions, making spam based attacks cheaper to run at scale.

How Address Poisoning Works

Address poisoning is a scam that targets wallet users by creating confusion in transaction histories. Attackers send very small transfers from wallet addresses that look similar to real ones. The goal is to trick users into copying the wrong address during a future transfer.

The process starts with what Sergeenkov calls “dust distributors.” These wallets send tiny amounts, often stablecoins, to a wide range of addresses.

To track these actors, Sergeenkov reviewed wallets that received less than $1 as their first stablecoin transfer. From there, he filtered for wallets that later sent funds to more than 10,000 addresses.

These wallets then broadcast dust transactions to massive address lists, filling transaction logs with fake but familiar looking entries.

Losses Continue to Grow

Some of the largest dust distributor wallets sent small transfers to more than 400,000 recipients each. According to Sergeenkov, this method has already resulted in more than $740,000 in losses.

A total of 116 victims have been identified so far. Losses occur when users mistakenly send larger sums to scam addresses copied from prior transactions.

Sergeenkov warned that while scaling infrastructure is important, security risks tied to low fees need more attention. He said address poisoning has become far more appealing to attackers as transaction costs fall.