Author: Oluwapelumi Adejumo
Compiled by: Luffy, Foresight News
Original title: Ethereum's strange phenomenon: high activity and dirt-cheap transaction fees, what's the catch?
Ethereum's current daily network growth data has reached an all-time high, and on the surface, this surge in statistics marks a significant return to user activity.
According to data from Token Terminal , the Ethereum mainnet processed 2.9 million transactions in the past week, breaking the historical record.
At the same time, the number of daily active addresses also saw a significant increase, rising from approximately 600,000 in late December to approximately 1.3 million.
The key point is that this explosive growth in throughput occurred while transaction costs remained extremely low. Despite record-high trading demand, average fees have consistently remained in the range of $0.1 to $0.2.
Ethereum on-chain activity, data source: Token Terminal
For Ethereum, a network whose transaction fees soared to $50 to $200 during the 2021-2022 NFT boom, the current changes signify a fundamental shift in the barrier to entry for transactions.
However, analysis shows that this growth is not entirely natural. While surface indicators may seem to signal a bull market recovery, security researchers warn that a significant amount of traffic on the network is actually driven by malicious actors.
These attackers are taking advantage of Ethereum's significantly reduced transaction fees to launch industrial-scale "address poisoning" attacks, disguising automated scams as legitimate transactions to precisely defraud users.
Network Expansion Background
To understand this sudden surge in transaction volume, it's essential to look at the recent structural changes to the Ethereum protocol. For years, while the Ethereum network has been powerful, its transaction costs have been prohibitively high for most people.
Leon Waidmann, research director at the Onchain Foundation, pointed out that since he entered the crypto industry, Ethereum mainnet transaction fees have been outrageously high for ordinary users.
He stated that Ethereum is not only too expensive for retail investors in terms of transaction costs, but also too costly for building consumer applications.
This situation took a turn for the better about a year ago: while striving to maintain decentralization and network security, the Ethereum development team systematically expanded and optimized the network.
A series of protocol upgrades have been implemented, advancing Ethereum's scaling roadmap, including three core upgrades.
The first upgrade was the Pectra upgrade in May 2025, which increased the target number of Blob data per block from 3 to 6, and the maximum number from 6 to 9, directly doubling the expected processing capacity of Blob data.
Subsequently, in December 2025, Ethereum completed the Fusaka upgrade, introducing PeerDAS (Peer Data Availability Sampling). This technology allows validators to verify the availability of Blob data through sampling, rather than downloading the entire dataset, thereby further improving network processing capacity while ensuring a reasonable threshold for node operation.
The latest upgrade, a Blob parameter-only fork in January 2026, increases the target number of Blobs per block from 10 to 14, with a maximum of 21. These upgrades aim to unlock significant network processing power for Ethereum.
The economic effects of the upgrade quickly became apparent: Ethereum mainnet transaction fees dropped significantly, and simple transactions returned to a low-cost state.
Leon Waidmann points out that large-scale development directly on the Ethereum mainnet is now feasible, which has driven prediction markets, real-world asset trading, and payment services to return to the mainnet.
Meanwhile, the volume of stablecoin transfers on the Ethereum network reached approximately $8 trillion in the fourth quarter of last year.
Ethereum's record-breaking activity has no real value to support it.
While the record-breaking activity may seem to signal Ethereum's rise, on-chain data shows that these transactions have not created real value for the network.
Alphractal data shows that the Metcalfe ratio, which measures the ratio of market capitalization to the square of the number of active users, is declining, meaning that Ethereum's valuation growth has failed to keep pace with actual network adoption.
Ethereum's Metacalfe ratio, source: Alphracta
Furthermore, Ethereum's network adoption score is currently at level 1, its lowest level in history. This data reflects the current market sluggishness, with network valuation relatively low compared to on-chain activity.
Based on this, Matthias Seidl, co-founder of GrowThePie, believes that the recent increase in Ethereum activity was not a natural occurrence.
He cited a single address as an example: that address received 190,000 ETH transfers from 190,000 unique wallets in a single day.
Matthias Seidl pointed out that the number of wallets receiving ETH transfers has remained relatively stable, but the number of wallets initiating transfers has increased significantly. He also emphasized that large ETH transfers only consume 21,000gas , which is the lowest-cost transaction type in the Ethereum Virtual Machine (EVM).
Ethereum EVM transaction costs, data source: GrowThePie
Currently, these low-cost native transfers account for nearly 50% of all Ethereum transactions. In contrast, sending an ERC20 token requires approximately 65,000 Gas, and the Gas cost of a single stablecoin transfer is equivalent to the sum of three ETH transfers.
Address poisoning: Scams are making a comeback.
Meanwhile, the surge in on-chain activity on Ethereum stems from a resurgence of an old scam that takes advantage of the era of low transaction fees.
Security researcher Andrey Sergeenkov points out that since last December, a wave of address poisoning attacks has been spreading rapidly by taking advantage of Ethereum's low gas fees: while boosting various network metrics, it implants fake addresses into users' transaction records, inducing users to transfer real assets to attackers.
The method of this type of attack is very simple: the fraudster generates a "poisoned address" that matches the first and last characters of the target user's legitimate wallet address; after the victim completes a normal transfer, the attacker sends a small "dust transaction" to make the fake address appear in the victim's recent transaction record.
They were betting that users would simply copy the seemingly familiar address from the transaction history when making subsequent transfers, without verifying the complete address string.
Based on this, Andrey Sergeenkov linked the surge in new Ethereum addresses to this scam. He estimated that the current number of new Ethereum addresses being created is about 2.7 times the average level in 2025, with the number of new addresses created in the week of January 12th surging to approximately 2.7 million.
Data on victims of address poisoning attacks, source: Andrey Sergeenkov
After analyzing the flow of funds behind this growth, he concluded that approximately 80% of the trading activity was driven by stablecoin transactions rather than natural user demand.
To verify whether this growth was caused by address poisoning, Andrey Sergeenkov looked for a key characteristic: the first transaction was an address receiving a transfer of less than $1 in stablecoins.
Statistics show that 67% of new addresses meet this characteristic. Specifically, among the 5.78 million new addresses, 3.86 million addresses received "dust transfers" as their first stablecoin transaction.
He then shifted his focus to the initiators of the transfers: analyzing accounts that sent less than $1 USDT and USDC between December 15, 2025 and January 18, 2026.
Andrey Sergeenkov counted the number of unique receiving addresses for each initiating account and filtered out accounts that sent transfers to at least 10,000 addresses. The results showed that these accounts were backed by smart contracts specifically designed for industrial-scale address poisoning; this type of code can fund and coordinate the operations of hundreds of poisoning addresses in a single transaction.
One of the contracts he studied contained a function labeled fundPoisoners, which, according to its description, could distribute stablecoin dust to a large number of poisoning addresses at once, along with a small amount of ETH to pay gas fees.
These poisoning addresses would then spread out, sending dust transfers to millions of potential targets, creating misleading entries in their wallets' transaction history.
The core of this scam model lies in its large-scale operation: although most recipients will not fall for it, as long as a very small percentage of users are deceived, the entire scam is economically feasible.
Andrey Sergeenkov estimates the scam's actual success rate to be approximately 0.01%, meaning its business model is built on tolerating an extremely high failure rate. In his analyzed dataset, 116 victims lost a total of approximately $740,000, with the largest single loss reaching $509,000.
Previously, the biggest constraint on such scams was cost. Address poisoning requires initiating millions of on-chain transactions, which themselves cannot directly generate revenue unless a victim transfers money to the wrong address.
Andrey Sergeenkov argues that Ethereum's network fees made such large-scale transfer scams unprofitable until the end of 2025. However, with transaction costs now down approximately sixfold, the risk-reward ratio has dramatically reversed, making the scam extremely attractive to attackers.
Therefore, he pointed out that if Ethereum does not strengthen user-facing security while improving transaction processing capabilities, it will create a distorted environment: the network's "record-breaking" activity will be indistinguishable from automated malicious behavior.
In his view, the crypto industry's excessive pursuit of network metrics may be masking a darker reality: low-cost blockchain space makes it easy for scams targeting large numbers of users to be disguised as legitimate network adoption, with the ultimate losses borne by the users.
Twitter: https://twitter.com/BitpushNewsCN
BitPush Telegram Community Group: https://t.me/BitPushCommunity
Subscribe to Bitpush Telegram: https://t.me/bitpush
