Ethereum Address Poisoning Attacks Surge 612% After Fusaka Upgrade

Ethereum's Fusaka upgrade, activated on December 3, 2025, has dramatically lowered transaction costs — and scammers have seized the opportunity. According to Etherscan data, USDT dust transfers surged 612% in the 90 days following the upgrade, marking an unprecedented spike in address poisoning attacks across the network.

«Original post» — etherscan.eth (@etherscan), March 12, 2026

Why This Matters

Address poisoning is among the most insidious crypto scams because it requires no wallet compromise or private key theft. Victims unknowingly send funds to a spoofed address copied from their own transaction history. With Fusaka slashing gas fees, the cost of broadcasting millions of fake micro-transactions has dropped to near zero, giving attackers an economic green light to scale operations massively.

Dust Transfer Growth Across Major Tokens

Comparing the 90-day windows before and after Fusaka's activation reveals a dramatic surge in micro-transactions valued below $0.01:

• USDT: +612% — from 4.2 million to 29.9 million transfers;
• USDC: +473% — from 2.6 million to 14.9 million;
• DAI: +470% — from 142,000 to 811,000;
• ETH: +62% — from 104.5 million to 169.7 million.

Regular transactions above the $0.01 threshold remained stable throughout the same period. This disparity clearly demonstrates that the spike is driven by deliberate malicious activity rather than organic network growth.

How Address Poisoning Works

The attack relies on automation and sheer volume. Scammers monitor the blockchain in real time, watching for large transfers. Once a target is identified, automated systems generate lookalike addresses that mimic the first and last characters of the victim's recent counterparties. Attackers then flood the victim's wallet with dust transfers so these spoofed addresses appear in the transaction history.

The bet is straightforward: a user copying an address from recent transactions may fail to notice the substitution and send funds directly to the attacker.

Competition among poisoning groups has become fierce. Etherscan screenshots show instances where up to 13 fraudulent transactions from different attackers appeared in a victim's history within just minutes of a legitimate USDT transfer.

A user named Nima shared his firsthand experience:

«Address poisoning attacks are getting out of hand. I just sent two stablecoin transactions and received +89 emails from my Etherscan address watch alert notifications. It took them <30 mins to create all of these on mainnet. So many will fall victim to this.» — Nima 👁️ (@0xNimaRa), original post

Two stablecoin transfers triggered over 89 alert notifications in under 30 minutes.

The Broader Damage

Address poisoning is far from a new phenomenon, but its scale continues to grow. Researchers at Blockchain Address Poisoning documented roughly 17 million spoofing attempts between July 2022 and June 2024. These attacks targeted approximately 1.3 million users, with cumulative losses exceeding $79 million.

Low-fee blockchains face even greater exposure. On Binance Smart Chain, the volume of spoofed transfers is 1,355% higher than on Ethereum.

Only a tiny fraction of attempts succeed — roughly 0.01%. Yet the sheer volume makes the scheme highly profitable. Etherscan noted that these campaigns broadcast thousands or even millions of fake transfers, and even a minuscule success rate generates substantial returns at that scale.

In December 2025, a single investor lost nearly $50 million to an address poisoning attack. Binance founder Changpeng Zhao subsequently proposed additional security measures aimed at eradicating the practice.