Amid low fees, activity on the main Ethereum network has outpaced that of Layer 2 solutions (L2). Analysts at Token Terminal described this trend as a "return to mainnet."
🪃⛓️ Return to Mainnet@ethereum L1 outranks all leading L2s in terms of daily active addresses.
— Token Terminal 📊 (@tokenterminal) January 22, 2026
Interesting. pic.twitter.com/Nk7O5adWA5
According to Etherscan, on January 16, the number of active addresses peaked at approximately 1.3 million. After a correction, the figure stabilized at 945,000 daily, still exceeding the metrics of leading L2 solutions: Arbitrum, Base, and OP Mainnet.
At the same time, liquidity is flowing out of "overlays": according to L2Beat, the total value locked (TVL) in the Layer 2 ecosystem has decreased by 17% over the year and currently stands at $45 billion.
Experts attribute the surge in activity to the December Fusaka update, which significantly reduced gas fees. However, they cautioned that a substantial portion of the traffic may be of "artificial origin" and not reflect the actions of real users.
Gas prices on the Ethereum network. Source: Etherscan.
Mass Spam?
Blockchain security expert Andrey Sergeenkov believes that the spike in Ethereum network activity is due to a wave of "address poisoning."
The expert considers the situation a mass spam attack. Following the Fusaka update, fees on the network dropped by over 60%, making fraudulent schemes profitable: attackers still gain even with a conversion rate of just 0.01% from victims.
"I wanted to find out what caused the surge in address creation, and it turned out that this unusual increase of 80% was due to stablecoin operations. Then I needed to understand their nature. I calculated how many users received less than $1 in their first transaction, and it turned out that 67% of wallets (3.86 million out of 5.78 million) fit this scheme," noted Sergeenkov.
The expert identified a network of smart contracts distributing microtransactions (less than $1) to thousands of wallets. The analysis covered the period from mid-December 2025 to January 2026.
Attackers create wallets that visually mimic user addresses (the beginning and end of the string match). They hope that victims will copy the fake details from their transaction history when making their next transfer.
According to Sergeenkov, 116 users fell for the trick, losing a total of over $740,000.
The economic feasibility of such actions is due to the reduced fees, making spam attacks on the network more accessible.
The King of Tokenization
Despite the suspiciously high on-chain activity, Ethereum remains the preferred blockchain for issuing tokenized real-world assets (RWA), as noted by ARK Invest.
The total value of assets on the network has surpassed $350 billion. Analysts predict that by 2030, the global market for tokenized instruments could reach $11 trillion.
Stablecoins make up the largest share — Ethereum holds 56% of this segment. Including L2, the ecosystem controls 66% of the RWA segment.
Notably, JPMorgan expressed doubts about Ethereum's long-term prospects.