Citi raises red flag over ‘address poisoning’ scams spreading across Ethereum

Ethereum’s recent spike in onchain activity is being driven largely by scam-related transactions rather than organic user growth, according to analysts at Citi.

The network has recorded a sharp increase in daily transactions and active addresses, reaching record levels. However, the Wall Street bank said the surge is unlikely to reflect sustainable expansion in real usage.

“This type of transaction behavior is typically associated with ‘address poisoning’ scam campaigns,” analysts Alex Saunders and Vinh Vo said in a report released Thursday.

Citi’s analysis found that a large share of the new activity involves transactions worth less than $1, a pattern more consistent with scam activity than legitimate adoption. Address-poisoning schemes involve malicious actors sending tiny amounts of crypto from wallet addresses that closely resemble those commonly used by victims, increasing the likelihood of misdirected funds in future transfers.

Low transaction fees on Ethereum have made it inexpensive for attackers to generate high volumes of these transactions, inflating headline network metrics without indicating genuine demand, the bank said.

The trend was also highlighted this week by onchain researcher Andrey Sergeenkov, who linked much of the recent activity spike to stablecoins. According to Sergeenkov, stablecoins account for roughly 80% of the unusual growth in new Ethereum addresses.

His analysis tracked USDT and USDC transfers below $1 and identified senders that distributed small amounts of stablecoins to at least 10,000 unique wallets. The largest of these were smart contracts that sent tiny transfers to hundreds of thousands of addresses, funded by mechanisms that allow poisoning campaigns to be executed in large batches.

Despite the burst of onchain activity, ether’s price has underperformed bitcoin over the same period. ETH has traded broadly flat so far this year, while BTC has gained about 2.4%, though ether has shown slightly stronger performance than bitcoin over the past six months.

Citi noted that Ethereum’s apparent activity boom contrasts with Bitcoin, where onchain usage has continued to drift modestly lower rather than surge. The divergence points to a network-specific phenomenon driven by “malicious behavior,” rather than evidence of broader growth across the crypto market.

JPMorgan has also expressed caution on Ethereum’s growth outlook. In a report published Wednesday, the bank said that while Ethereum’s December Fusaka upgrade led to an immediate drop in fees alongside a jump in transactions and active addresses, it remains uncertain whether the rebound can be sustained amid rising competition from layer-2 networks and rival blockchains.