The team behind Etherscan, Ethereum’s main block explorer, published a report on March 12 documenting a sustained increase in address poisoning attacks. (address poisoning) on the network and identifies the Fusaka update, activated in December 2025, as the main factor that accelerated them.
The connection between the hacks and the update, according to Etherscan research, is direct: Fusaka reduced transaction costs on Ethereum while simultaneously increasing the volume of activity on the chain.
The lower the cost per transaction, the more poison attempts an attacker can execute with the same budget.
To emphasize this increase in on-chain activity, and in poisoning attempts, Etherscan points out that in the 90 days after Fusaka, Ethereum processed 30% more daily transactions and the number of new addresses created each day increased by 78% compared to the 90 days before the update.
Those high levels of activity in Ethereum and low commissions reported by Etherscan coincide with recent records from NoticiasVE and they are still maintained today, according to on-chain data.
How does the scam facilitated by Fusaka operate?
Behind the increase in scams highlighted by the Etherscan team are so-called “dust transfers” (dust transfersin English), which are the main vector that hackers use to execute address poisoning and hack wallets.
A poison address is a fake wallet address, designed to imitate a legitimate one, that attackers insert into a user’s transaction history so that they mistakenly copy it and unknowingly send them funds.
The mechanism works like this: attackers monitor the Ethereum network using automated systems to detect legitimate user operations. Then, generate a fake address that only imitates the first and last characters of the address with which that user just operated.
From this fake address, the attacker makes a “dust transfer” that consists of a minimum transfer (below USD 0.01) to the victim’s wallet. The only purpose of this sending is for the false address to be recorded in the transaction history.
The next time the victim needs to send funds, if you copy the address from that history without checking each characteryou will end up sending the money to the attacker.
The image below, recorded by Etherscan, illustrates the scale and speed of these attacks. The last transaction in the list (marked with a green checkmark) corresponds to a legitimate USDT transfer:
In the following minutes, 13 fake addresses were automatically inserted into the history of that same wallet, each imitating the visible characters of the legitimate address, but not the rest of the characters of the direction. Etherscan marks them with a skull icon to warn the user. Each of those addresses marked with a skull belongs to a different attacker: they all compete to be the first to appear in the history and increase the chances that the user copies their address in the next transfer.
With Fusaka making each transaction cheaper, executing thousands of those shipments became more accessible. In the three months following this update, according to Etherscan, las dust transfers of USDT increased by 612%going from 4.2 million to 29.9 million. Those of USDC grew by 473%, from 2.6 million to 14.9 million, and those of the DAI stablecoin by 470%.
Few successes, but enough to be a business
The Etherscan report indicates that the success rate per attempt It is just 0.01%. One in every 10,000 attempts results in a victim.
However, when attacks are executed at millions of simultaneous attempts, even that fraction generates significant gains. In December 2025, a user lost USD 50 million in an attack of this typea case cited in the Etherscan investigation.
Next, a 2025 study cited by Etherscan to carry out its research recorded 17 million poisoning attempts between July 2022 and June 2024, targeting 1.3 million users on Ethereum, with confirmed losses of at least $79.3 million. What was once an occasional tactic has become, according to the report, an industrialized operation with multiple groups of attackers competing with each other to be the first to insert their fake address into a victim’s history.
Faced with this panorama, the Etherscan report warns that the solution cannot be exclusively technical.
For users, the central recommendation is always check the full address Before confirming any transfer, use address books in wallets to mark frequent contacts and do not copy addresses directly from transaction history.
What did Fusaka bring to Ethereum and how did he accelerate those attacks?
Fusaka is an Ethereum update that introduced 13 Improvement Proposals (EIPs). Many of them were aimed at increase network scalability and decrease transaction fees.
Although Etherscan did not specify which specific EIPs were referred to the attackers, one of the most relevant in that sense could be EIP-7935, which increased the gas limit per block allowing more simultaneous transactions and reducing competition for space in each block, which can lead to fewer fees.
Likewise, Fusaka’s most relevant improvement, called PeerDAS (EIP-7594), improved efficiency in data management for second layer (L2) networks, indirectly making low-value transactions such as dust transfers.
A pattern that already occurred with another Ethereum update
Fusaka’s case is not the first in which an Ethereum update introduces legitimate improvements that end up being exploited by attackers.
In May 2025, the Pectra update implemented EIP-7702, a proposal that allows users to delegate functions to smart contracts to simplify transactions: instead of signing multiple separate authorizations, the EIP-7702 allows them to be grouped into a single transaction with a single signature.
In that case, the attack vector was phishing. Users received a fraudulent link that invited them to «mint» or «claim» an asset. By connecting your wallet and approving the bundled transaction, They unknowingly authorized the complete emptying of their funds in a single step, with no possibility of reversing it.
Thus, both Fusaka and Pectra illustrate a structural tension of Ethereum development: The same improvements that make the network more efficient, accessible and more functional also expand the space for new attack vectors to be exploited.