Address Poisoning: $37.7M Monthly Losses and CZ's Spam Filter Proposal

The threat is volatile but persistent, with financial flows showing a sharp recent dip. February 2026 ended with the lowest monthly loss figure since March 2025 at $37.7 million. This drop was driven by the absence of any single catastrophic incident, highlighting how the scam's impact is heavily concentrated in isolated, high-value attacks rather than a steady drip.

The scale of a single successful attack can be staggering. In December 2025, a landmark address poisoning scam saw one victim lose approximately $50 million in USDT. That single loss accounted for roughly half of the month's total confirmed losses, demonstrating how a few well-executed scams can dominate the monthly financial picture and drive the overall narrative.

Operationally, the attack surface is massive and daily. Security firm Cyvers estimates there are over 1 million address-poisoning "preparations" per day on Ethereum. This daily volume of scam attempts, often targeting millions of users, shows the persistent, industrial-scale nature of the threat. The February dip in losses is therefore a temporary lull, not a sign of decline, as the underlying attack infrastructure remains active and ready.

CZ's Proposed Defense and Industry Adoption

CZ's core proposal is a direct, automated block: wallets should automatically check if a receiving address is associated with known poisoning activity and block users from sending funds to it. This leverages on-chain queries to known malicious addresses, a technical fix that could stop the scam at the point of transaction initiation. His secondary, less technical suggestion is to filter out spam micro-transactions used to pollute transaction histories from wallet interfaces, aiming to remove the bait that tricks users.

The industry is already moving toward this model. Trust Wallet has launched a real-world implementation, rolling out its Address Poisoning Protection across 32 EVM chains. It uses aggregated intelligence from partners like Binance Security to flag lookalike addresses before transactions, providing side-by-side comparisons to highlight differences. This mirrors CZ's vision of automatic, real-time alerts built into the user's workflow.

Yet significant vulnerabilities remain. The attack surface is enormous, with over 1 million address-poisoning "preparations" per day on Ethereum. A defense system is only as good as its intelligence network and update speed. The Trust Wallet solution relies on shared blacklists, which creates a dependency on the timeliness and accuracy of those sources. Until such protections are universal across all major wallets and chains, the scam will persist for users on less secure platforms.

Catalysts, Risks, and What to Watch

The primary catalyst for a structural shift is the industry-wide adoption of proactive blocking. While warning systems are a start, the real game-changer is automatic transaction interception. If major wallets implement CZ's vision of automatically checking if a receiving address is associated with known poisoning activity and blocking users from sending funds to it, the scam's success rate could plummet. The recent Trust Wallet rollout is a positive signal, but universal adoption across all chains and wallets is the critical threshold.

A key risk is the scam's evolution into multi-chain campaigns, which increases its resilience and reach. Evidence shows attackers are already moving beyond Ethereum. A recent sophisticated attack targeted Safe{Wallet} users, exploiting the platform's nested features to bulk-create ~15,000 malicious proxy addresses. This demonstrates a shift toward coordinated, automated assaults across multiple ecosystems, making it harder for defenses based on single-chain intelligence to keep pace.

The key metric to watch is the monthly scam loss report. The February 2026 figure of $37.7 million is a notable low, but it was driven by the absence of a single catastrophic incident. A sustained increase above this baseline would signal that defensive measures are failing and the scam's profitability is rising. Conversely, a consistent drop would indicate that proactive blocking is taking hold and the threat is being contained.