Ethereum address poisoning attacks have escalated sharply, prompting Binance founder Changpeng Zhao to call out block explorers publicly. In a post on X, Zhao argued that platforms like Etherscan should not display spam transactions that enable these scams. He said "Block explorers should not show these spam transactions. Should be simple to filter them out completely. TrustWallet does this already." He also noted that AI could later help filter spam for micro-transactions between AI agents.
Automated Address Poisoning at Scale
Security researchers report that attackers now automate the creation of fake wallet addresses that closely mimic legitimate ones. They send tiny amounts of tokens to a target, planting the fake address in the victim's transaction history. Users often copy addresses from past transfers — a single wrong pick can redirect a large payment to the attacker.
The economics are brutal. Analysts estimate a success rate of roughly 0.01%, meaning one victim per 10,000 attempts. But a single successful transfer often involves a large sum, easily covering the cost of thousands of failed tries. This makes the attack model sustainable even at low hit rates.
Fusaka Update Lowered Fees, Opened Door for Spam
The surge followed the Ethereum Fusaka upgrade, which cut transaction fees to improve efficiency. Cheaper fees also made it far cheaper for attackers to run spam campaigns. Etherscan had previously warned users about address poisoning, but the problem has clearly worsened.
Industry experts urge users to verify addresses character by character before each transaction — a single wrong character can permanently lock funds. Wallets with built-in protection, such as TrustWallet's default filtering of suspicious zero-value transfers, provide an extra safety layer. Developers are also exploring AI-driven detection to flag abnormal transaction patterns in real time.
Block explorers remain the primary gateway for on-chain data. If major platforms like Etherscan do not adopt proactive filtering, security risks will likely keep mounting.