Etherscan warns of surge in address poisoning scams on Ethereum after Fusaka upgrade

Etherscan released a warning to Ethereum (ETH) users about a sharp increase in “address poisoning” scams, a social engineering tactic that manipulates wallet transaction histories to redirect funds to attackers. In an X post on Thursday, the blockchain explorer explained that attackers are now running these operations on a large scale.

Attackers double down on poisoning efforts

The scam begins when automated bots monitor normal blockchain transfers. Soon after a transaction occurs, the bots create new wallet addresses that closely resemble the address a user recently interacted with. These fake addresses usually match the first and last characters of the real one.

Attackers then send small “dust” transfers to the victim’s wallet, often worth only fractions of a cent in stablecoins such as USDT. The goal is to place the fake address inside the victim’s transaction history. When the user later copies an address from a previous activity, they may accidentally select the poisoned one and send funds directly to the attacker.

Although the tactic has existed for years, Etherscan argued that it has grown rapidly. The firm noted that about 17 million address poisoning attempts targeted 1.3 million users on Ethereum between July 2022 and June 2024. The attacks led to at least $79.3 million in confirmed losses.

The activity appears even more common on networks like BNB Smart Chain (BSC), where lower transaction fees allow attackers to run far more attempts. Etherscan stated that poisoning attacks occur more than 1,300% more frequently on that network.

The rise in attacks also coincides with Ethereum’s Fusaka upgrade, which went live in December. The upgrade reduced transaction costs and improved network efficiency, but it also made it cheaper for attackers to send large numbers of dust transactions.

Data further shows Ethereum processed roughly 30% more transactions per day in the 90 days after the upgrade. During the same period, the number of newly created addresses increased by 78%.

Dust transfers involving stablecoins also rose sharply. USDT transactions worth less than $0.01 increased by 612%, jumping from about 4.2 million to nearly 29.9 million. Similar spikes occurred with USDC and Dai, which saw increases of 473% and 470%, respectively.

Etherscan added that attackers often compete with each other to poison wallets as quickly as possible. In one example cited by the firm, a single legitimate USDT transfer triggered 13 separate dust transactions within minutes.

Despite the low success rate of these scams, the strategy remains profitable because the cost per attempt is extremely low. Etherscan estimates that only about 0.01% of poisoning attempts succeed. However, when attackers run millions of transactions, even a few successful scams can produce large returns.

Reports from Coin Metrics previously highlighted an attacker address that sent nearly 3 million dust transfers to more than 1 million unique wallets.

To reduce the risk of falling victim to address poisoning, Etherscan urged users to verify full wallet addresses before sending funds. The firm also recommended saving trusted addresses using private name tags or the Ethereum Name Service, enabling address highlighting tools, and using wallet contact whitelists where possible.

The report comes as Ethereum has been seeing record network growth. Active addresses and transaction counts have surged to record highs, surpassing levels seen during the 2021 bull market. However, ETH’s price has dipped more than 50% over the past 12 months despite the rise.

ETH is trading at $2,120 at the time of publication on Thursday, up 3% over the past 24 hours as of writing.