A sharp rise in activity on the Ethereum network is being driven largely by scam related behavior rather than genuine user growth, according to new analysis from Citigroup. The bank’s analysts noted that recent spikes in daily transactions and active addresses are dominated by transfers worth less than one dollar, a pattern inconsistent with organic adoption. Instead, the data points to widespread use of address poisoning tactics, where attackers send tiny amounts of crypto from wallet addresses designed to closely resemble those of legitimate recipients. The aim is to trick users into mistakenly copying and reusing fraudulent addresses in later transactions. Low transaction fees on Ethereum have made it cheap to execute these campaigns at scale, inflating headline network metrics without reflecting real economic demand or user engagement.
Further onchain analysis shows that stablecoins are central to this activity. Researchers tracking transaction flows found that a large share of the new addresses receiving sub dollar transfers were interacting with stablecoins rather than ether itself. These transfers were often generated by smart contracts capable of distributing small amounts of tokens to tens of thousands of wallets in a single operation. The pattern suggests coordinated campaigns rather than dispersed retail usage. Analysts highlighted that while Ethereum’s transaction count has climbed to record levels, the economic value of those transactions remains minimal. This divergence between volume and value complicates interpretations of network health, especially as stablecoins now play a dominant role in day to day onchain activity across multiple blockchains.
The contrast with Bitcoin further supports the view that Ethereum’s surge is not part of a broader market expansion. Onchain activity on Bitcoin has continued to trend slightly lower, avoiding the sharp spikes seen on Ethereum. Price performance has also diverged, with ether showing weaker momentum compared to bitcoin over recent months. Citi’s analysts described the Ethereum spike as a network specific phenomenon tied to malicious behavior rather than renewed investor interest. Other banks have echoed caution, questioning whether recent upgrades and fee reductions can sustain meaningful growth amid competition from layer two networks and alternative chains. The findings underscore how raw activity metrics can be misleading when low cost transactions enable large scale spam and scams.
