Address poisoning: up 612% after Fusaka
Around 17 million poisoning attempts on Ethereum from 2022 to 2024, at least US$79.3 million confirmed lost. Cheaper gas took the attacker’s cost to almost nothing.
This is a summary of the key points, not a full reprint. Read the original in full here:
- Etherscan warns users after victim receives 89 address-poisoning emailsCryptopolitan · 2026-03-12
- Crypto trader loses $50 million in address poisoning attack, offers $1 million bounty for returnThe Block · 2025-12-20
In March 2026 Etherscan warned that address poisoning had got significantly worse on Ethereum since the Fusaka upgrade. It targets your receiving address directly, so it is worth understanding how it works.
The numbers
- Between July 2022 and June 2024, researchers counted roughly 17 million poisoning transfers on Ethereum, hitting 1.33 million addresses, with at least US$79.3 million in confirmed losses.
- After Fusaka activated on 3 December 2025 and cut gas costs, stablecoin dust transfers under one cent rose 612%—from about 4.2 million to 29.9 million.
- In December 2025 a single trader lost close to 50 million USDT to one of these attacks, and publicly offered a US$1 million bounty for the return of the rest.
The 612% does not mean the attack got smarter. It means it got cheaper. Spraying dust is purely a cost problem—when gas drops, the same budget covers several times as many targets.
Worth knowing that the 612% figure is contested. Analysing the same period, Coin Metrics puts the increase closer to two or three times and points out that dust is only about 11% of Ethereum transactions, with most post-Fusaka growth being genuine usage. Both readings agree the volume went up; they disagree on how alarming that is.
The method: it attacks your copy-paste habit
The attacker generates a fake address whose first and last characters closely match one you use often, then sends a tiny transfer to your wallet. The point is not to steal that transfer—it is to get the fake address into your transaction history.
Next time you send funds and copy the address out of your history—and most wallet interfaces only show the first and last few characters—there is a chance you copy the fake one. Once it is sent, it is over. Nobody can claw it back.
This is the other face of the dust attack. The same tiny transfer, sent to an exchange deposit address, is meant to taint your address score and trip risk controls; sent to a personal wallet, it is meant to pollute your transaction history and get you to copy the wrong address. One cheap action, two payoffs.
What you can do
- Do not copy addresses out of your transaction history. Use your wallet’s address book or allowlist, or fetch the address from its original source every time.
- Check the middle of an address, not just the ends—the truncated display is exactly what the attacker is aiming at.
- For a large transfer, send a small test first and confirm it arrived. That cost is far below the cost of getting it wrong once.