The Ethereum block explorer Etherscan has issued a stark warning following a massive, automated wave of 'address poisoning' attacks targeting users. The alert was prompted by a specific case where a user, identified as Nima, received 89 alert emails in less than 30 minutes after simply moving stablecoins on the network.
Address poisoning is a scam where attackers flood a victim's transaction history with tiny, near-zero value transfers sent to addresses that mimic the first and last characters of the victim's legitimate contacts. The goal is to trick the user into accidentally copying one of these fake addresses for a subsequent, larger transaction, thereby sending funds directly to the scammer.
The scale of the problem has grown dramatically. Data indicates that in 2026 alone, these scams have already drained $62 million, including a single theft of $24 million. A 2025 study covering July 2022 to June 2024 found over 17 million poisoning attempts against 1.3 million users, with confirmed losses exceeding $79 million.
A key catalyst for the surge is the Fusaka upgrade activated on December 3, 2025, which significantly reduced network fees. This economic shift has made it profitable for criminals to execute massive automated campaigns. Post-upgrade, daily transaction volume increased by 30%, while 'dust' transfers (worth less than $0.01) for stablecoins like USDC and USDT skyrocketed by 473% and 612%, respectively.
Despite a success rate as low as 0.01% to 0.1%, the sheer volume of attempts ensures profitability. The attacks are now highly automated and rapid, with cases of 13 fake addresses being planted in a user's history just minutes after a real transaction.
To combat this, Etherscan recommends users employ private labels and its 'Address Highlight' feature for visual differentiation. The explorer has also begun automatically labeling and hiding zero-value transfers to clean up transaction histories. The evolution of address poisoning from a minor nuisance to a structural threat underscores the critical need for users to verify every character of an address before confirming any transfer.
