Ethereum Fees Drop Triggers Surge in Scams? Address Poisoning Attacks Skyrocket, USDT Micro Transactions Spike 612%

On March 13, it was reported that as transaction costs on the Ethereum network decrease, on-chain security issues have once again attracted attention. Recent data shows that after the Fusaka upgrade in December 2025, “address poisoning attacks” in the Ethereum network have significantly increased, with a large number of small transfers used to forge transaction records, misleading users into transferring funds to scam addresses.

Address poisoning refers to attackers creating addresses that closely resemble real wallet addresses, then sending tiny amounts of transactions to the target wallet, also known as “dust transfers.” These transactions are recorded in users’ transaction histories. Because Ethereum addresses are 42 characters long, some users only check the first and last few characters when copying addresses, which can lead to mistakenly sending funds to fake addresses.

Blockchain explorer Etherscan’s statistics show that this attack pattern is not new. From July 2022 to June 2024, approximately 17 million address poisoning attacks targeted about 1.3 million Ethereum users, resulting in confirmed losses of at least $79.3 million.

However, after the Fusaka upgrade, the number of small transactions has increased markedly. Data shows that small transactions of stablecoins USDT surged from about 4.2 million to nearly 29.9 million, an increase of approximately 612%; USDC small transactions grew from 2.6 million to 14.9 million, about 473%; DAI transactions increased from around 142,000 to 811,000, nearly 470%.

Small “dust transactions” of Ethereum’s native asset ETH also rose from about 104.5 million to 169.7 million, an increase of roughly 6.52 million transactions, about 62%. Etherscan noted that shortly after the Fusaka upgrade, small transactions below $0.01 spiked rapidly, then declined but remained significantly higher than pre-upgrade levels.

Although the success rate of these scams is not high—about 1 in 10,000 attacks succeed—each operation costs very little, so successful attacks can yield substantial profits, prompting attackers to continue using this strategy.

Researchers also pointed out that address poisoning attacks are becoming more industrialized. Multiple scam groups often target the same wallet address simultaneously, attempting to insert fake addresses into users’ transaction records first, increasing the likelihood of user errors.

It is important to note that not all small transfers are malicious. Some transactions may be normal token exchanges or test transfers. However, security agencies remind users to carefully verify complete wallet addresses when reviewing transaction records and avoid copying addresses directly from history to reduce the risk of funds being stolen.