Mass Address Poisoning Campaign (Ethereum 2025-2026)
Summary
An industrialized, automated address poisoning campaign targeting Ethereum users accelerated sharply after the Fusaka protocol upgrade on December 3, 2025 reduced gas fees approximately sixfold, removing the prior economic barrier to mass-scale dust-transaction attacks. Security firm ScamSniffer documented at least $62.25 million in confirmed losses across two high-profile victims in December 2025 and January 2026 alone, while Blockaid flagged over 65.4 million poisoning transactions since January 2025 averaging 160,000 per day. The campaign represents a commercial, industrialized threat infrastructure sold as a service on Telegram rather than a single threat actor, and is ongoing as of the research date.
Connected Entities
1 entities · 10 linked investigations- + 5 more
Timeline(15 events)
2022-07-01
Academic study baseline period begins: researchers later document 270 million address poisoning attempts and $83.8 million in losses across Ethereum and BSC between July 2022 and June 2024.
Blockchain Address Poisoning (Tsuchiya et al., USENIX Security 2025)2024-05-01
$68 million WBTC stolen in address poisoning incident; approximately 22,960 ETH partially recovered within one week through deanonymization and negotiation.
CryptoDaily: Address Poisoning in 20262025-01-01
Blockaid begins tracking address poisoning transactions on-chain; 65.4 million transactions flagged in the subsequent 12+ months at an average of 160,000 per day.
Blockaid: Address Poisoning — The Growing Threat Draining Millions from Crypto Users2025-11-01
Blockaid records approximately 628,000 poisoning attempts in November 2025, representing the pre-Fusaka baseline.
Blockaid: Address Poisoning — The Growing Threat Draining Millions from Crypto Users2025-12-03
Ethereum Fusaka upgrade activates, reducing transaction fees approximately sixfold and removing the primary economic barrier to mass-scale address poisoning campaigns.
BeInCrypto: Address Poisoning Attacks Surge on Ethereum Following Fee Reduction2025-12-19
Unnamed victim loses $49,999,950 USDT in the largest recorded single address poisoning theft. Attacker detected a $50 test transaction, inserted a spoofed address into transaction history, and received the full transfer 26 minutes later. Stolen funds laundered via Tornado Cash within approximately 30 minutes.
CoinDesk: Crypto User Loses $50 Million in Address Poisoning Scam2025-12-20
CoinDesk and Web3 Antivirus publicly disclose the $50 million USDT address poisoning theft.
CoinDesk: Crypto User Loses $50 Million in Address Poisoning Scam2025-12-24
Binance co-founder Changpeng Zhao (CZ) publishes a call for all wallets to implement default address-poisoning detection, block known poison addresses, and participate in shared industry blacklists.
CryptoPotato: After $50M USDT Theft, Binance's CZ Pushes Wallets to Block Poison Addresses by Default2026-01-16
Ethereum sets a new daily transaction record of 2.89 million transactions, a post-Fusaka peak partly attributable to address poisoning dust traffic.
Coin Metrics State of the Network Issue 3492026-01-26
Safe{Wallet} nested Safe poisoning campaign identified as active from at least this date. Attackers bulk-created approximately 15,000 malicious proxy addresses exploiting Safe's nested Safe feature.
Blockaid: Address Poisoning — The Growing Threat Draining Millions from Crypto Users2026-01-30
Victim loses 4,556 ETH (approximately $12.4 million) after copying an OTC deposit address from transaction history. Attacker had conducted a two-month preparatory dusting campaign from December 2025 onward, using a vanity address matching both prefix and suffix of the legitimate address.
Blockaid: Address Poisoning — The Growing Threat Draining Millions from Crypto Users2026-01-31
Blockaid records approximately 3.4 million poisoning attempts in January 2026, a 5.5x increase from November 2025's 628,000, and the highest monthly total documented.
Blockaid: Address Poisoning — The Growing Threat Draining Millions from Crypto Users2026-02-08
ScamSniffer publishes report disclosing combined $62.25 million in address poisoning losses across December 2025 and January 2026.
Crypto.news: Ethereum address poisoning costs $62M in two months2026-02-09
Coin Metrics publishes State of the Network Issue 349, quantifying post-Fusaka dust transaction impact: ~11% of all Ethereum transactions, ~26% of active addresses daily attributable to stablecoin dust activity.
Coin Metrics State of the Network Issue 3492026-04-01
CryptoDaily publishes analysis describing address poisoning as a commercialized industry with Telegram-based service offerings, and noting that no named threat actors have been publicly identified or prosecuted.
CryptoDaily: Address Poisoning in 2026 — How the Attack Became an IndustryDecision Log
- hash: DXrYGoQQ4t7qd62pMFvfhXUXadTzx8amV4t9TspMMM9o
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-code-investigator
generated: 6/2/2026, 8:04:23 PM
last updated: 6/2/2026, 8:05:05 PM
avoid.net — verified advice for a post-truth world