A groundbreaking new report from Citibank has cast a shadow over Ethereum's recent record-breaking network activity, revealing that a historic spike in transaction volume is being driven by highly sophisticated "address poisoning" campaigns rather than organic adoption. Released on Thursday, the Citibank crypto report 2026 dissects the sudden explosion in on-chain data, warning investors and users that the network is currently under siege by an industrial-scale fraud operation.

The Illusion of Growth: Analyzing the ETH Network Activity Surge

On the surface, the Ethereum network appeared to be entering a golden era of utilization earlier this week. Daily transaction counts soared to an all-time high of nearly 2.9 million, while the creation of new wallets spiked by an unprecedented 400% in a single week. However, Citi analysts Alex Saunders and Vinh Vo have categorized this ETH network activity surge as a "false boom" manufactured by malicious actors.

According to the bank's detailed on-chain forensic analysis, the vast majority of these new transactions are micro-transfers valued at under $1. These "dust" transactions are not evidence of retail adoption or DeFi innovation but are instead the primary mechanic of a widespread security threat known as address poisoning. "This transaction trend is often associated with 'address poisoning' scam campaigns," the analysts noted, highlighting that raw metrics are currently misleading indicators of blockchain health.

How Address Poisoning Scams Work

Ethereum address poisoning is a social engineering attack that exploits the complexity of blockchain addresses and human psychology. Scammers use specialized software to generate "vanity addresses" that closely mimic a victim's legitimate wallet address—typically matching the first and last four to six alphanumeric characters. Once generated, the attacker sends a negligible amount of cryptocurrency (often zero-value tokens or mere pennies of stablecoins) to the victim's wallet.

The goal is simple but effective: to poison the victim's transaction history. When a user later attempts to send funds, they may inadvertently copy the scammer's lookalike address from their recent history instead of their intended destination. Because the addresses look nearly identical at a quick glance, even experienced crypto users can fall prey to these blockchain transaction scams. The Citi report indicates that over 80% of the unusual growth in new addresses is directly linked to these stablecoin dust transfers.

The "Fusaka" Factor: Why Now?

The timing of this scam wave is not coincidental. Security researchers, including independent analyst Andrey Sergeenkov, have pointed to the recent "Fusaka" network upgrade as a catalyst. Implemented in late 2025 to improve scalability, the upgrade successfully reduced average transaction fees by over 60%. While beneficial for legitimate users, this efficiency has inadvertently lowered the barrier to entry for scammers.

Previously, executing an attack of this magnitude—spamming millions of addresses—would have cost attackers upwards of $2.5 million. Today, the same campaign can be launched for a fraction of that cost. Sergeenkov's analysis uncovered smart contracts specifically designed to industrialize this process, including a function labeled fundPoisoners that automates the distribution of ETH for gas to thousands of scam wallets simultaneously. In one instance, a single smart contract was found repeatedly funding a network of bot wallets to target over 400,000 unique users.

Financial Impact and Victim Profile

The financial toll is already mounting. Early estimates suggest that over $740,000 has been pilfered in just the last few weeks, with one unfortunate victim losing over $500,000 in a single transfer. Unlike typical phishing scams that target novices, Ethereum micro-transactions used in poisoning attacks often target high-net-worth individuals and active traders who frequently move large sums and rely on transaction history for convenience.

Crypto Security Alert: How to Stay Safe

In light of these findings, security experts are issuing a critical crypto security alert to all Ethereum users. To protect your assets from address poisoning:

  • Never copy-paste from transaction history: Always copy addresses from a trusted external source or your own address book.
  • Verify every character: Don't just check the first and last few digits. Malware and vanity generators can easily spoof these segments.
  • Use Whitelisting: Enable address whitelisting on your exchange accounts and wallets to restrict withdrawals to known, safe addresses.
  • Ignore "Dust": If you see tiny, unexpected deposits in your wallet, do not interact with them. They are likely bait.

As the Citibank crypto report 2026 concludes, while low fees are essential for Ethereum's long-term success, they demand a higher degree of vigilance from users. The network is scaling, but so are the threats.