Blockchain experts analyzing transaction records on the Ethereum network have uncovered a sharp rise in new, automated scam campaigns that exploit user habits rather than technical vulnerabilities. In particular, address poisoning attacks have become increasingly prominent, catching users off guard by leveraging subtle tactics embedded within routine transactions.
How Address Poisoning Attacks Work
This sophisticated scam involves attackers creating wallet addresses that closely mimic the recent transaction history of their targets. Since crypto users often check only the first and last few characters of an address before transferring funds, criminals craft so-called “vanity” addresses that appear nearly identical to legitimate ones. Typically, they make minuscule transfers—often worth less than a cent—to ensure these fake addresses show up in the user’s transaction log. Later, if a user copies the wrong address from their own history for a new transfer, they may unwittingly send funds to the scammer.
Surge in Attacks After Ethereum Update
Powered by automation, these large-scale operations escalated significantly following Ethereum’s Fusaka network upgrade on December 3, 2025. The upgrade reduced transaction fees, making it easier for malicious actors to launch a higher volume of fraudulent transactions. Stablecoins such as USDT, USDC, and DAI saw a major surge in “dust” transfers under a cent—the types of microtransactions often exploited in these attacks. Etherscan data reveals that the frequency of such microtransactions jumped by 612 percent for USDT, 473 percent for USDC, and 470 percent for DAI after the update.
Etherscan emphasized that address poisoning attacks have grown more widespread and automated on the Ethereum network, with attackers inserting misleading addresses into users’ transaction histories to trick them into misdirecting funds.
Automated bots play a key role by monitoring real-time network traffic and promptly sending small transfers from lookalike addresses after detecting user activity. Since many wallet interfaces display only shortened versions of addresses, the fraudulent entries often appear legitimate at first glance.
Heavy Losses and Security Concerns
Address poisoning attacks have made headlines, particularly after the loss of approximately $24 million in aEthUSDC by a user known as Sillytuna in March 2026. Security researchers estimate that in the first two months of 2026 alone, these scams have accounted for around $62 million in damages.
Some incidents highlight the speed and automation of these schemes: in certain cases, just two genuine transfers were quickly followed by as many as 89 fake transfers within a 30-minute window, flooding the transaction log with deceptive entries.
Expert Advice for Staying Safe
Crypto security professionals and Etherscan recommend always verifying the full wallet address before sending funds, warning against relying solely on abbreviated address displays. They also suggest enabling Etherscan’s Address Highlighting feature, which helps mark trusted addresses and more easily spot unfamiliar or suspicious entries.
Additional precautions include using name resolvers like Ethereum Name Service (ENS) or maintaining an address book with personalized labels, both of which can help prevent the reuse of addresses tainted by previous scam attempts. Some blockchain explorers even default to hiding zero-value or low-value suspicious transfers, contributing to both a cleaner user interface and enhanced security.
Heightened Risks for Ethereum Users
With automation and social engineering working hand-in-hand, address poisoning attacks on Ethereum are becoming more widespread. Lower transaction fees have multiplied the number of malicious microtransactions. In this environment, carefully confirming the full destination address for every transfer is essential to avoid falling victim to these increasingly sophisticated scams.
