Citi flags growing wave of ‘address poisoning’ scams on Ethereum

A surge in activity on the Ethereum network to record levels is being driven largely by scam-related transactions rather than genuine user adoption, according to analysts at Citi.

Daily transactions and active addresses on Ethereum have climbed sharply in recent weeks, but the rise does not point to sustainable network growth, the Wall Street bank said in a report published Thursday.

“This pattern of transaction activity is commonly linked to ‘address poisoning’ scam campaigns,” analysts Alex Saunders and Vinh Vo wrote.

Citi’s analysis shows a high concentration of transactions worth less than $1, a hallmark of address-poisoning activity rather than organic usage. In such schemes, attackers send tiny amounts of crypto from wallet addresses designed to closely resemble those frequently used by victims, increasing the risk that users later send funds to the wrong address.

Low transaction fees on Ethereum have made it cheap and efficient for attackers to generate large volumes of these transactions, artificially boosting headline network metrics without signaling real demand, the analysts said.

Onchain researcher Andrey Sergeenkov separately highlighted the trend this week, noting that stablecoins account for roughly 80% of the recent surge in new Ethereum addresses. His research tracked USDT and USDC transfers under $1 and identified senders that distributed small amounts of stablecoins to at least 10,000 unique wallets.

The largest of those senders were smart contracts that pushed tiny stablecoin transfers to hundreds of thousands of addresses, funded through functions that allow large batches of poisoning transactions to be executed in a single transaction.

Despite the spike in onchain activity, ether’s price has lagged bitcoin over the same period. ETH has traded largely flat so far this year, underperforming BTC, which is up about 2.4%, though ether has slightly outperformed bitcoin over the past six months.

Citi said Ethereum’s activity spike stands in contrast to Bitcoin, where onchain usage has continued to trend modestly lower rather than accelerate. The divergence suggests Ethereum’s recent surge is a network-specific issue driven by “malicious behavior,” not a sign of broader crypto market growth.

JPMorgan has echoed a cautious view on Ethereum’s outlook. In a note published Wednesday, the bank said that while the network’s December Fusaka upgrade triggered an immediate drop in fees and a jump in transactions and active addresses, it remains uncertain whether that momentum can be sustained amid competition from layer-2 networks and rival blockchains.