A correlation between the drop in mainnet fees following the Fusaka upgrade and a rise in network attacks was outlined by some analysts.
An unusually high spike in activity is being seen on the Ethereum mainnet, even surpassing metrics across Layer 2s that were initially designed as more scalable alternatives to the network.
Headline figures concerning active addresses and transaction counts are being distorted by dust attacks and so-called “address-poisoning” campaigns rather than organic network activity, researchers caution.
In a social media update on January 22, 2026, it was flagged by Token Terminal that Ethereum’s Layer 1 chain “outranks all leading L2s in terms of daily active addresses.”
On Friday, Jan. 16, the network was reported by Token Terminal to have reached 1.2 million active daily addresses, a substantial rise from the previous peak of 589,000 recorded in July.
An all-time high of approximately 2.8 million transactions was reached by the network that day, according to BitInfoCharts data, while about 2.5 million transactions have been processed in the past 24 hours.
Previous cycle peaks—including those linked to CryptoKitties, the DeFi summer, and the 2021-2022 NFT boom—are being overshadowed by the recent surge in mainnet activity.
Stablecoins Are Spreading Across Crypto
A different narrative is being hidden behind the spike, according to independent crypto journalist and on-chain researcher Andrey Sergeenkov. In a recent report, it was found by Sergeenkov that over $740,000 worth of cryptocurrency has been stolen by automated poisoning contracts that have been sending tiny stablecoin amounts of less than $1 to millions of addresses.
The scam is executed by sending negligible quantities of cryptocurrency to addresses that appear virtually identical to those frequently utilized by the intended victim, with the aim of manipulating them into inadvertently directing future transfers to the fraudulent lookalike.
“I calculated how many users received less than a dollar as their first stablecoin transaction, and it turned out 67% of addresses fit this pattern. 3.86M out of 5.78M addresses received dust as their first transaction,”
Sergeenkov writes.
The spam attacks across Ethereum became possible “thanks to the Fusaka upgrade, which made spam transactions cheap enough to be profitable,” according to Sergeenkov. These concerns were reportedly echoed by analysts at Citi, who stated in a report this week that the current activity on Ethereum highly resembles “address poisoning scam campaigns.”
It was concluded by Sergeenkov that what developers are doing is “reckless experimentation at users’ expense disguised as a revolution where ordinary people bear all the risks.”
Calls Grow to Address Fundamental Issues
Some pushback was offered by critics against Sergeenkov’s findings, with the researcher’s characterization of Fusaka being labeled a “crazy take” and the argument being made that security is “usually a tradeoff against usability.”
In an interview with , the notion that the problem stems from unavoidable trade-offs was rejected by Sergeenkov. Expanding on his earlier “reckless experimentation” critique, Sergeenkov told the publication:
“If anything, I’m being too gentle. To experiment means you don’t know the outcome. Developers KNEW about the effect their upgrade would cause and chose to sacrifice security for nice headlines anyway,” explaining further that the connection between lower fees and increased attacks “wasn’t just predictable, it was documented.”
It was also stated by Sergeenkov that the real impact on users is masked by portraying these protocol changes as improvements to the user experience.
“Before attracting new users with low fees, they need to fix fundamental problems first. If they’re unable to fix them, maybe they should declare the Ethereum experiment a failure and take up knitting instead of promoting themselves as a ‘Trillion Dollar Security’ replacement for existing financial infrastructure,”
he added.
Weighing the Security Tradeoffs
The block gas limit on Ethereum was raised and other features for Layer 2s were introduced by the Fusaka upgrade when it went live in December of last year. Its primary aim was to support scalability and long-term growth rather than to directly cut Layer 1 transaction fees.
“This upgrade does not lower gas fees on L1, at least not directly. The main focus is more blob space for rollup data, therefore lowering fees on layer 2. This might have some side effects on L1 fee market but no significant change is expected.”
The developers specifically noted in the roadmap for the upgrade:
A slight decrease in L1 fees was observed following the Fusaka upgrade, nonetheless. Data from BitInfoCharts shows that the average Ethereum transaction fee fell from around $0.50 in late November to about $0.20 after the upgrade went live in December.
It was pointed out by Gonçalo Magalhaes, head of security at the blockchain bug bounty firm Immunefi, that while Ethereum upgrades like Fusaka and Pectra “are pushing UX forward by removing friction,” they also “make it easier for users to inadvertently sign something they don’t fully understand.”
Consequently, the industry requires “more adoption of naming systems like ENS, because human-readable identifiers make lookalike address attacks harder,” as argued by Magalhaes.
For Sergeenkov, the fix needs to come from Ethereum at the infrastructure level, before the network scales to billions of users, per the Ethereum Foundation’s stated goals.
“I’m not claiming we need to implement 100x fees. I’m saying that before lowering fees and scaling the blockchain, we need to solve the most basic infrastructure problems that enable dust attacks, social engineering attacks, MEV bots, and the ease with which attackers launder stolen funds.”
He told :
The researcher also pushed back against the notion that wallets should bear the responsibility and implement UI changes to address these issues, clarifying to , “Fixing the UX of wallets and educating users are band-aids that didn’t work even when the community was just a group of tech enthusiasts.”
Inquiry was made by to the Ethereum Foundation regarding the network activity spike and the implications of Sergeenkov’s and Citi’s findings, but commentary has yet to be received by press time.
