Mass Address Poisoning Campaign (Ethereum 2025-2026)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·hZ4kmV…LKE2Summary
An industrialized, automated address poisoning campaign targeting Ethereum users accelerated sharply after the Fusaka protocol upgrade on December 3, 2025 reduced gas fees approximately sixfold, removing the prior economic barrier to mass-scale dust-transaction attacks. Security firm ScamSniffer documented at least $62.25 million in confirmed losses across two high-profile victims in December 2025 and January 2026 alone, while Blockaid flagged over 65.4 million poisoning transactions since January 2025 averaging 160,000 per day. The campaign represents a commercial, industrialized threat infrastructure sold as a service on Telegram rather than a single threat actor, and is ongoing as of the research date.
Connected Entities
1 entities- + 5 more
Timeline(15 events)
July 2022
Academic study baseline period begins: researchers later document 270 million address poisoning attempts and $83.8 million in losses across Ethereum and BSC between July 2022 and June 2024.
Blockchain Address Poisoning (Tsuchiya et al., USENIX Security 2025)May 2024
$68 million WBTC stolen in address poisoning incident; approximately 22,960 ETH partially recovered within one week through deanonymization and negotiation.
CryptoDaily: Address Poisoning in 20262025
Blockaid begins tracking address poisoning transactions on-chain; 65.4 million transactions flagged in the subsequent 12+ months at an average of 160,000 per day.
Blockaid: Address Poisoning — The Growing Threat Draining Millions from Crypto UsersNovember 2025
Blockaid records approximately 628,000 poisoning attempts in November 2025, representing the pre-Fusaka baseline.
Blockaid: Address Poisoning — The Growing Threat Draining Millions from Crypto Users3 December 2025
Ethereum Fusaka upgrade activates, reducing transaction fees approximately sixfold and removing the primary economic barrier to mass-scale address poisoning campaigns.
BeInCrypto: Address Poisoning Attacks Surge on Ethereum Following Fee Reduction19 December 2025
Unnamed victim loses $49,999,950 USDT in the largest recorded single address poisoning theft. Attacker detected a $50 test transaction, inserted a spoofed address into transaction history, and received the full transfer 26 minutes later. Stolen funds laundered via Tornado Cash within approximately 30 minutes.
CoinDesk: Crypto User Loses $50 Million in Address Poisoning Scam20 December 2025
CoinDesk and Web3 Antivirus publicly disclose the $50 million USDT address poisoning theft.
CoinDesk: Crypto User Loses $50 Million in Address Poisoning Scam24 December 2025
Binance co-founder Changpeng Zhao (CZ) publishes a call for all wallets to implement default address-poisoning detection, block known poison addresses, and participate in shared industry blacklists.
CryptoPotato: After $50M USDT Theft, Binance's CZ Pushes Wallets to Block Poison Addresses by Default16 January 2026
Ethereum sets a new daily transaction record of 2.89 million transactions, a post-Fusaka peak partly attributable to address poisoning dust traffic.
Coin Metrics State of the Network Issue 34926 January 2026
Safe{Wallet} nested Safe poisoning campaign identified as active from at least this date. Attackers bulk-created approximately 15,000 malicious proxy addresses exploiting Safe's nested Safe feature.
Blockaid: Address Poisoning — The Growing Threat Draining Millions from Crypto Users30 January 2026
Victim loses 4,556 ETH (approximately $12.4 million) after copying an OTC deposit address from transaction history. Attacker had conducted a two-month preparatory dusting campaign from December 2025 onward, using a vanity address matching both prefix and suffix of the legitimate address.
Blockaid: Address Poisoning — The Growing Threat Draining Millions from Crypto Users31 January 2026
Blockaid records approximately 3.4 million poisoning attempts in January 2026, a 5.5x increase from November 2025's 628,000, and the highest monthly total documented.
Blockaid: Address Poisoning — The Growing Threat Draining Millions from Crypto Users8 February 2026
ScamSniffer publishes report disclosing combined $62.25 million in address poisoning losses across December 2025 and January 2026.
Crypto.news: Ethereum address poisoning costs $62M in two months9 February 2026
Coin Metrics publishes State of the Network Issue 349, quantifying post-Fusaka dust transaction impact: ~11% of all Ethereum transactions, ~26% of active addresses daily attributable to stablecoin dust activity.
Coin Metrics State of the Network Issue 349April 2026
CryptoDaily publishes analysis describing address poisoning as a commercialized industry with Telegram-based service offerings, and noting that no named threat actors have been publicly identified or prosecuted.
CryptoDaily: Address Poisoning in 2026 — How the Attack Became an IndustryDecision Log
- hash: GcREYZUAMsf4usPzfPEQufLLYywq77BqTq8nYWLc89W9
- hash: 4hpiJe4Srp11ovQJKHPF1DPUKJxNd3usPFinEP9MscAt
- hash: DXrYGoQQ4t7qd62pMFvfhXUXadTzx8amV4t9TspMMM9o
This investigation is cryptographically anchored to the Solana blockchain (3 events). 16 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 6/2/2026, 8:04:23 PM
last updated: 7/26/2026, 11:10:19 PM
avoid.net — verified advice for a post-truth world