Ethereum Mainnet Activity Surge Driven by Address Poisoning Scams, Citi Warns

Jan 23, 2026, 9:20 a.m. 6 sources neutral

Key takeaways:

  • Analysts warn Ethereum's address surge is scam-driven, questioning the sustainability of its recent user growth narrative.
  • The Fusaka upgrade's lower fees inadvertently enabled spam attacks, creating a misleading signal for network health metrics.
  • Despite artificial activity, Ethereum maintains dominance in on-chain assets, suggesting underlying strength amid noisy data.

Ethereum's mainnet has experienced a dramatic spike in daily active addresses, surpassing all major Layer-2 scaling solutions, but analysts from Citigroup warn the surge is largely artificial, driven by a wave of "address poisoning" scams. According to data from Token Terminal, Ethereum mainnet daily active addresses recently closed in on 1 million, peaking at around 1.3 million on January 16 before settling to approximately 945,000. This figure now outranks leading Layer-2 networks like Arbitrum One, Base Chain, and OP Mainnet.

The resurgence in mainnet activity follows December's Fusaka upgrade, which dramatically reduced gas fees. However, Citi analysts Alex Saunders and Vinh Vo released a report on Thursday cautioning that most of the new activity consists of transactions worth less than $1, a pattern indicative of scam campaigns rather than genuine user growth. They attribute the economic viability of these spam attacks directly to the post-upgrade slump in network fees.

Address poisoning involves scammers sending tiny transactions from wallet addresses that closely resemble legitimate ones, hoping users will mistakenly copy the fraudulent address for future transactions. On-chain researcher Andrey Sergeenkov found that roughly 80% of the unusual growth involves stablecoin transfers under $1, with the largest operations using smart contracts to distribute funds to hundreds of thousands of wallets in single batches.

Blockchain security firm Cyvers corroborated these findings, telling Cointelegraph that behavioral classification and statistical correlation "strongly suggest that address poisoning is not a marginal factor, but a significant contributor to the recent rise in Ethereum transaction volume." This network-specific activity contrasts with Bitcoin, whose on-chain metrics have trended modestly lower during the same period.

Despite the spurious activity, Ethereum's fundamental position remains strong. ARK Invest reported that Ethereum "remains the preferred blockchain for on-chain assets," which now exceed $400 billion on the network. Data from RWA.xyz shows Ethereum commands a 56% share of on-chain stablecoins and a 66% share of all tokenized real-world assets when Layer-2 networks are included. The total value secured across all Layer-2s currently stands at $45 billion, down 17% over the past year.

Disclaimer

The content on this website is provided for information purposes only and does not constitute investment advice, an offer, or professional consultation. Crypto assets are high-risk and volatile — you may lose all funds. Some materials may include summaries and links to third-party sources; we are not responsible for their content or accuracy. Any decisions you make are at your own risk. Coinalertnews recommends independently verifying information and consulting with a professional before making any financial decisions based on this content.