Amid low fees, activity on the main Ethereum network has outpaced that of second-layer (L2) solutions. Analysts at Token Terminal described this trend as a “return to mainnet.”
đȘâïž Return to Mainnet@ethereum L1 outranks all leading L2s in terms of daily active addresses.
Interesting. pic.twitter.com/Nk7O5adWA5
â Token Terminal đ (@tokenterminal) January 22, 2026
According to Etherscan, on January 16, the number of active addresses peaked at approximately 1.3 million. After a correction, the figure stabilized at 945,000 per day, still surpassing the metrics of L2 segment leaders: Arbitrum, Base, and OP Mainnet.
Simultaneously, there is a liquidity outflow from “overlays”: according to L2Beat, the total TVL of the second-layer ecosystem has decreased by 17% over the year and stands at $45 billion.
Experts linked the surge in activity to the December update of Fusaka, which sharply reduced gas costs. However, they cautioned that a significant portion of the traffic might be “artificial” and not reflect real user actions.
Mass Spam?
Blockchain security specialist Andrey Sergeenkov believes that the spike in Ethereum network activity is due to a wave of address “poisoning.”
The expert considers the situation a mass spam attack. After Fusaka, network fees dropped by more than 60%. This made fraudulent schemes profitable: perpetrators remain in the black even with a victim conversion rate of 0.01%.
“I wanted to find out what caused the surge in address creation, and it turned out that this unusual 80% increase was due to stablecoin operations. Then I needed to understand their nature. I calculated how many users received less than $1 in their first transaction, and it turned out that 67% of wallets (3.86 million out of 5.78 million) fit this pattern,” noted Sergeenkov.
The expert identified a network of smart contracts sending microtransactions (less than $1) to thousands of wallets. The analysis covered the period from mid-December 2025 to January 2026.
Perpetrators create wallets that visually mimic user addresses (matching the beginning and end of the string). They hope the victim will copy the fake details from the transaction history when making the next transfer.
According to Sergeenkov’s data, 116 users fell for the trick, collectively losing over $740,000.
The economic feasibility of such actions is due to the reduction in fees, making spam attacks on the network more accessible.
The King of Tokenization
Despite the suspiciously high on-chain activity, Ethereum remains the preferred blockchain for hosting tokenized real-world assets (RWA), noted ARK Invest.
The total value of funds on the network exceeded $350 billion. Analysts predict that by 2030, the global market for tokenized instruments could reach $11 trillion.
Stablecoins account for the majority â Ethereum holds 56% of this segment. Including L2, the ecosystem controls 66% of the RWA segment.
Previously, JPMorgan questioned the long-term prospects of Ethereum.
