Ethereum's mirage: When address poisoning is disguised as network growth

The recent record levels of daily Ethereum transactions paint a deceptive picture. What initially seems like a sign of dynamic growth turns out to be a classic mirage on closer analysis – a mirage on the crypto market that has been created by systematic fraud. Investment banks such as Citi are now explicitly warning against interpreting these activity metrics as indicators of true network health.

Fraudulent transactions flood the Ethereum network

The rise in on-chain activity on Ethereum is impressive at first, with network metrics seeing record highs in daily transaction volumes and active wallet addresses. But this upswing is overshadowed by an uncomfortable truth. As Citi analysts Alex Saunders and Vinh Vo reveal in their latest report, the bulk of this supposedly new activity consists of transactions with values below one dollar.

This pattern is characteristic of so-called address poisoning campaigns – a sophisticated scam in which malicious actors send tiny amounts of cryptocurrency from fake wallet addresses to make them appear deceptively similar to commonly used addresses. The goal is to trick users into accidentally sending their funds to the wrong destination in future transactions. Ethereum’s current low transaction fees – measured cost minimizations in the cent range – make such mass campaigns extremely cost-effective for attackers to carry out.

The result is paradoxical: the seemingly thriving network metrics are artificially inflated without reflecting actual demand or organic user adoption. It is the classic mirage of a healthy ecosystem.

Stablecoins as the main driver of bogus activity

Onchain researcher Andrey Sergeenkov provided concrete data on the dimension of this phenomenon this week. His analysis shows that stablecoins – especially USDT and USDC – are responsible for about 80 percent of the unexpected surge in new wallet addresses. The researched patterns are revealing: Sergeenkov isolated smart contracts that distributed tiny amounts of these stablecoins under one dollar to several hundred thousand different wallets.

The structure of these operations suggests coordination. A single funding mechanism – designed as a batch process for large-volume poisoning campaigns – makes it possible to fund tens of thousands of fake addresses in a single transaction. This is less a product of random activity and more the result of systematically orchestrated scams.

Citi and JPMorgan: Warning signs from Wall Street institutions

Both leading investment banks are converging in their skeptical assessment of Ethereum metrics. While Citi makes the causation of address poisoning campaigns clear, JPMorgan is critical on another level: While the bank confirms that the network upgrade in December led to immediate fee reductions and an increase in activity, it questions the sustainability of this recovery.

JPMorgan’s concerns relate to structural issues with the Ethereum ecosystem. Growing competition from Layer 2 solutions and rival blockchains threatens the long-term relevance of the mainnet. A recovery based on technical improvements can easily erode if there is no real user demand – and this is by definition absent in poisoning campaigns.

Bitcoin remains stable, Ethereum dances in the mirage

The divergent development between Ethereum and Bitcoin sheds a clear light on the differences between real growth and mirages. Bitcoin continues to see a slight decline in on-chain activity — a pattern that the bank says points to consolidation, not fraud or manipulated metrics. At the same time, Bitcoin’s price performance shows: With an increase of around 2.4 percent in the period under review, the leading cryptocurrency demonstrates more stable gains than Ethereum.

Ether (ETH), on the other hand, showed higher volatility at the same time. With a current price of around $2.78K and Bitcoin at $83.69K, both assets have been trading in a volatile environment. The 1-year analysis shows the weaker development: While Bitcoin is down about 17.25 percent, Ethereum is slightly better with a decline of around 9.91 percent. Still, Ethereum has lost the year-to-date comparison and ETH has remained virtually unchanged, while BTC has made modeste gains over the same period.

This duality reveals the core problem: Ethereum’s surge in activity is a network-specific phenomenon caused by malicious manipulation rather than real growth.

The Real Picture: Spam Stifles Real Use

Beneath the superficial shine of the record metrics hides a more problematic narrative. The network effects that blockchain enthusiasts hoped for are being overshadowed by spam and fraud. This has far-reaching consequences for the perception of Ethereum – among both institutional and retail investors.

Spot crypto exchange volumes have plummeted to about $900 billion from $1.7 trillion a year ago — a halving that reflects cooling market enthusiasm and cautious investor sentiment amid macroeconomic uncertainties. In this context, bloated on-chain metrics seem particularly questionable like a mirage: they suggest vitality where problems are fermenting in reality.

On the other hand, Bitcoin miners who have shifted their business models to AI infrastructure and high-performance computing have demonstrated above-average performance – a sign of real, purposeful use of the Bitcoin network beyond speculation.

Conclusion: Between appearance and real growth

Citi’s warnings and JPMorgan’s skepticism are not just academic exercises. They mark a turning point in the reality check of the Ethereum ecosystem. The mirage of address poisoning shows how easily cryptographic network metrics can be distorted by coordinated efforts.

For investors and developers, this means an important lesson: Superficial metrics – transaction counts, active addresses, volume growth – should always be checked against the light of real network health and user needs. Ethereum’s short-term spike in activity may look impressive, but the substance behind it reveals a reliance on scams rather than organic ecosystem fundamentals.