Following the implementation of the Fusaka upgrade, the blockchain activity landscape has undergone an unexpected transformation. For the first time in a long while, the Ethereum mainnet (L1) has begun outperforming popular Layer 2 (L2) solutions like Arbitrum and Base.
While analysts describe this trend as a “return to the mainnet,” security experts warn that these impressive numbers may hide a large-scale coordinated attack.
The Numbers: Mainnet is Trending Again
According to data from Token Terminal and Etherscan, the reduction in network fees has triggered a sharp influx of users (or their imitations) back to the primary layer.
Activity Comparison (January 2026)
| Metric | Value | Context / Dynamics |
| Peak Active Addresses | ~1.3M | Record high for the recent period (Jan 16) |
| Stable Daily Active Users | 945,000 | Higher than Arbitrum, Base, and OP Mainnet |
| L2 Ecosystem Total TVL | $45B | 17% year-over-year decline |
In tandem with the L1 growth, there is a noticeable outflow of liquidity from “secondary layers.” The Total Value Locked (TVL) across the L2 ecosystem has dipped, confirming a trend of capital migrating back to the “parent” network.
The Dark Side of Cheap Gas: An “Address Poisoning” Epidemic
The primary driver of this growth is the Fusaka upgrade, which slashed gas costs by over 60%. However, affordable transactions have proven to be a double-edged sword. Blockchain security specialist аrgues that up to 80% of the surge in new addresses is driven by spam attacks.
Specifically, the “address poisoning” scheme has become economically viable due to the lower fees.
“I analyzed the transaction structure: 67% of wallets (3.86M out of 5.78M) received less than $1 in their first transaction. This is a clear sign of a smart contract network distributing micro-transactions to mimic activity and contaminate transaction histories,” Sergeenkov noted.
How the Scam Works:
- A scammer creates an address that visually mimics yours (matching the first and last few characters).
- They send a “dust” or micro-transaction to your wallet.
- The goal is for you to accidentally copy the scammer’s address from your transaction history the next time you initiate a transfer.
The Result: So far, 116 victims have been confirmed, losing a combined total of over $740,000. With current low fees, scammers only need a conversion rate of 0.01% to remain highly profitable.
Ethereum: Still the “King of Tokenization”
Despite the noise generated by spam bots, Ethereum’s fundamentals remain robust, particularly in the RWA (Real World Assets) sector. ARK Invest analysts emphasize that institutional players still prefer the mainnet for long-term capital placement.
- Dominance: The Ethereum ecosystem (including L2s) controls 66% of the tokenized asset segment.
- Stablecoins: The mainnet accounts for 56% of the entire stablecoin market.
- Forecast: Experts estimate the global market for tokenized instruments could reach $11 trillion by 2030, with Ethereum positioned as the primary settlement layer.
Summary
The Fusaka upgrade achieved its main goal: making Ethereum accessible. However, the “side effect” has been increased vulnerability to low-cost spam. Users are advised to exercise extreme caution and always verify the full recipient address, rather than relying on their transaction history.
