Ethereum's Fusaka Upgrade Fuels Record Address Poisoning Attacks

The Fusaka upgrade significantly reduced gas fees, enabling large-scale address poisoning attacks by making spam transactions economically viable.

Over 167,000 daily dust transactions were recorded, resulting in $63 million in losses due to address errors.

Security researchers are advocating for measures like address truncation and safer address book practices to mitigate these risks.

The Ethereum Fusaka upgrade slashed gas fees sixfold, unintentionally enabling large-scale address poisoning attacks through spam transactions that exploit user errors in copying and pasting wallet addresses. According to analysis, these attacks involve sending tiny amounts of cryptocurrency to user wallets to trick users into sending funds to a malicious address. The reduced gas fees made these attacks significantly more scalable and economically viable.

Over two months, more than 167,000 daily dust transactions were recorded, resulting in $63 million in losses. The Ethereum Foundation faces pressure to address these security risks while advancing its 2026 roadmap, which includes increasing gas limits and improving user experience. Security researchers have highlighted the need for additional user education and technological safeguards like address truncation and safer address book practices to mitigate these risks.

Post-Fusaka upgrade, stablecoin dust attacks on Ethereum have surged, now accounting for 11% of total on-chain transactions and 26% of daily active addresses, with significant losses reported. Coin Metrics analyzed over 227 million USDC and USDT balance updates between November 2025 and January 2026, finding that 43% involved transfers of less than $1. Before the upgrade, dust transactions made up 3-5% of transactions and 15-20% of active addresses, but these figures increased to 10-15% of transactions and 25-35% of active addresses after the upgrade. These attacks typically involve malicious actors sending small amounts of stablecoins from addresses that appear legitimate, tricking users into copying incorrect addresses. Over $740,000 has been lost to address spoofing attacks.

What is the impact of the Fusaka upgrade on Ethereum's security?

The Fusaka upgrade has had a significant impact on Ethereum's security by enabling large-scale address poisoning attacks. These attacks exploit user errors in copying and pasting wallet addresses, leading to financial losses. The reduced gas fees made these attacks significantly more scalable and economically viable. The Ethereum Foundation is launching a DeFi unit to strengthen privacy, security, and institutional adoption.

What measures are being proposed to mitigate these risks?

Security researchers are advocating for measures like address truncation and safer address book practices to mitigate the risks associated with the Fusaka upgrade. The Ethereum Foundation is under pressure to address these security risks while advancing its 2026 roadmap. Experts emphasize the need for a balance between usability and security to prevent further network vulnerabilities.

What is the broader context of Ethereum's roadmap and security challenges?

Ethereum's roadmap includes increasing gas limits and improving user experience, but this must be balanced with security considerations. The Ethereum Foundation is also exploring other upgrades, such as EIP-8141, which aims to fully implement account abstraction. An AI security firm recently identified a high-severity bug in Ethereum's Nethermind software before it could be exploited. These developments highlight the ongoing challenges and innovations in Ethereum's security landscape.