TLDR
- Ethereum network saw a record spike in daily transactions and active addresses, but Citi analysts say most are worth less than $1
- The surge is linked to “address poisoning” scams where attackers send tiny amounts from similar-looking wallet addresses to trick users
- Low transaction fees after December’s Fusaka upgrade made these spam campaigns economically viable for scammers
- Researcher tracked stablecoin transfers under $1 going to hundreds of thousands of wallets from smart contracts designed for mass poisoning
- Bitcoin activity has trended lower during the same period, showing the Ethereum spike is network-specific rather than market-wide growth
Ethereum recently hit record levels for daily transactions and active addresses. But Wall Street bank Citi says the growth is not what it seems.
Ethereum reached an all-time high in the number of new addresses on mainnet.
More people and institutions transacting means more value moving onchain and subsequently Ethereum’s TVL rising. pic.twitter.com/16P55StpmT
— SharpLink (SBET) (@SharpLink) January 22, 2026
The bank’s analysts Alex Saunders and Vinh Vo released a report on Thursday. They warned that most of the new activity consists of transactions worth less than $1.
This pattern points to address poisoning scam campaigns rather than real user growth. The analysts said these scams have become cheaper to run thanks to Ethereum’s low transaction fees.
Address poisoning works by sending tiny amounts of crypto from wallet addresses that look similar to ones victims use regularly. Scammers hope users will copy the wrong address when making future transactions.
The December Fusaka upgrade caused Ethereum’s gas fees to drop sharply. This made it economically viable for attackers to spam the network with thousands of small transactions.
Stablecoins Drive Suspicious Activity
Onchain researcher Andrey Sergeenkov found that roughly 80% of the unusual growth in new addresses involves stablecoins. He tracked USDT and USDC transfers under $1.
Sergeenkov identified senders distributing small amounts to at least 10,000 unique addresses. The largest operations used smart contracts to send tiny stablecoin amounts to hundreds of thousands of wallets.
These contracts included special functions designed to fund large batches of poisoning addresses in single transactions. Etherscan data showed active addresses surged to around 1.3 million on January 16 before settling to roughly 945,000.
Bitcoin Shows Different Pattern
Bitcoin’s onchain activity has drifted modestly lower during the same period. Citi analysts said this divergence shows Ethereum’s spike is network-specific.
The pattern appears driven by malicious behavior rather than broader crypto market growth. Ether’s price has been flat this year while Bitcoin has risen 2.4%.
Blockchain security firm Cyvers told reporters on Wednesday that behavioral analysis strongly suggests address poisoning is a major contributor. The firm said poisoning is not a marginal factor but a material driver of recent transaction volume.
Token Terminal reported on Thursday that Ethereum mainnet now surpasses all layer-2 scaling blockchains in daily active addresses. The platform called it a “return to mainnet” enabled by lower gas fees.
JPMorgan also expressed doubts about Ethereum’s growth outlook in a Wednesday report. The bank questioned whether the rebound would last given competition from layer-2 blockchains and rival chains.
Despite the suspicious activity, ARK Invest reported that Ethereum remains the preferred blockchain for onchain assets. Assets on Ethereum now exceed $400 billion with stablecoins making up the bulk.
Ethereum commands a 56% share of stablecoins onchain according to RWA.xyz. When layer-2 networks are included, Ethereum holds a 66% share of all tokenized real-world assets.
