Address Poisoning Attacks Surged on Ethereum After Fusaka Upgrade

The increasing frequency of address poisoning attacks on the Ethereum network has prompted Etherscan, a platform for equitable access to human-readable blockchain data, to educate crypto users about how to protect themselves from falling victim.

In its latest post on X, Etherscan dissected the address poisoning technique often used by hackers to steal users’ funds across crypto networks, educating crypto community members on how to protect themselves from falling victim to this expanding phenomenon. According to Etherscan, the surge in wallet address poisoning highlights how automated and high-volume the campaigns have become.

For context, address poisoning refers to a technique in which crypto thieves insert lookalike addresses into crypto users’ wallet address history, potentially deceiving them into sending future transactions to the wrong destination—the thieves’ wallets. One Etherscan user recently shared an after receiving about 89 address watch alert emails minutes after making two stablecoin transfers.

According to Etherscan, the escalated pattern observed today involves attackers who often monitor blockchain activity to identify potential targets. After detecting a transaction, they swing into action, with automated systems generating lookalike addresses that mimic the beginning and ending characters of legitimate addresses the target has interacted with.

The hackers follow up by sending poison transfers to the target address, so the “spoofed address” appears in the transaction history. Typically, these hackers focus on addresses that make frequent transfers, hold significant token balances, or are involved in large transfers. Meanwhile, a study shows that address poison attacks surged alongside the increased transaction volume observed on the Ethereum network after the Fusaka Upgrade, which significantly reduced transaction costs.

Etherscan has highlighted the steps crypto users should adopt to avoid falling victim to address poisoning attacks. They include making frequently used crypto addresses recognizable with name tags or domain names and implementing the Etherscan address-highlighting feature. However, the blockchain platform advised users to double-check every wallet address to ensure authenticity before executing crypto transactions.