Ethereum

ZachXBT

Crypto phishing attacks tied to wallet drainers dropped sharply in 2025, with total losses falling to $83.85 million, down 83% year over year from nearly $494 million in 2024.
The number of victims also declined significantly to 106,000, a 68% drop from the previous year, &nbsp;Web3 security platform Scam Sniffer <a href="https://drops.scamsniffer.io/scam-sniffer-2025-crypto-phishing-losses-fall-83-to-84-million/" rel="noopener noreferrer nofollow" target="_blank">said</a> in its new report analyzing signature-based phishing across <a href="https://cointelegraph.com/news/what-is-an-ethereum-virtual-machine-evm-and-how-does-it-work" rel="noopener noreferrer nofollow">Ethereum Virtual Machine (EVM)</a> chains.
Despite the steep fall, the report warned that phishing activity has not disappeared. Instead, losses closely followed market cycles, rising during periods of higher onchain activity and easing as markets cooled. The third quarter of 2025, which coincided with Ethereum (ETH)’s strongest rally of the year, recorded the highest phishing losses at $31 million, with August-September accounting for nearly 29% of annual losses.
“When markets are active, overall user activity increases, and a percentage fall victim — phishing operates as a probability function of user activity,” the report said. Monthly losses ranged from $2.04 million in December, the quietest month, to $12.17 million in August, during peak market activity.
<figure>
 <img alt="Crypto phishing losses fell 83% in 2025, but drainer ecosystem ‘remains active’" src="https://s3.cointelegraph.com/uploads/2026-01/019b83bf-fb3d-7280-9056-648f92c9b2b8.png" title="">
 <figcaption style="text-align: center;">
 Monthly phishing losses and victims. Source: <a href="https://drops.scamsniffer.io/scam-sniffer-2025-crypto-phishing-losses-fall-83-to-84-million/" rel="noopener noreferrer nofollow" target="_blank">Scam Sniffer</a>
 </figcaption>
</figure>
Related: <a href="https://cointelegraph.com/news/hundreds-evm-wallets-drained-mysterious-attack" rel="noopener noreferrer nofollow">'Hundreds' of EVM wallets drained in mysterious attack: ZachXBT</a>
<h2 id="6-5-million-permit-phishing-attack-tops-2025-losses">$6.5 million permit phishing attack tops 2025 losses</h2>
The largest single phishing theft of the year <a href="https://cointelegraph.com/news/slowmist-uncovers-5-emerging-crypto-scams-q2" rel="noopener noreferrer nofollow">totaled $6.5 million</a> in September and involved a malicious Permit signature, suggesting that Permit and Permit2 approvals remain the most effective tools for attackers. Overall, Permit-based attacks accounted for 38% of losses among incidents exceeding $1 million.
However, 2025 also marked the <a href="https://cointelegraph.com/news/pectra-wallet-exploit-offchain-signature-risk" rel="noopener noreferrer nofollow">emergence of a new attack vector</a>. EIP-7702–based malicious signatures appeared shortly after Ethereum’s Pectra upgrade, allowing attackers to exploit account abstraction and bundle multiple harmful actions into a single user signature. Two major EIP-7702 cases in August resulted in $2.54 million in losses, highlighting how quickly attackers adapt to protocol-level changes.
Notably, large-scale incidents declined, with only 11 cases exceeding $1 million in 2025, down from 30 in 2024. However, the report noted that attackers increasingly favor lower-value, higher-volume strategies. The average loss per victim fell to $790, suggesting a shift toward broader, retail-focused campaigns rather than isolated, high-profile thefts.
“The drainer ecosystem remains active — as old drainers exit, new ones emerge to fill the gap,” the report concluded.
Related: <a href="https://cointelegraph.com/news/crypto-security-phishing-supply-chain-attacks" rel="noopener noreferrer nofollow">Crypto hack counts fall, but supply chain attacks reshape threat landscape</a>
<h2 id="crypto-hack-losses-fell-60-in-december">Crypto hack losses fell 60% in December</h2>
As Cointelegraph reported, crypto-related losses from hacks and cybersecurity exploits <a href="https://cointelegraph.com/news/losses-crypto-hacks-down-60-december" rel="noopener noreferrer nofollow">dropped to about $76 million</a> in December, down 60% from November’s $194.2 million, according to PeckShield. The firm recorded 26 major incidents during the month, indicating a slowdown in overall losses even as attack activity remained persistent.
The largest case involved a $50 million <a href="https://cointelegraph.com/news/address-poisoning-attacks-in-crypto" rel="noopener noreferrer nofollow">address poisoning scam</a>, where attackers use lookalike wallet addresses to trick victims into misdirecting funds, while another incident saw $27.3 million lost through a private key leak tied to a <a href="https://cointelegraph.com/learn/articles/what-is-multisignature-wallet" rel="noopener noreferrer nofollow">multi-signature wallet</a>.
Magazine: <a href="https://cointelegraph.com/magazine/meet-crypto-sleuths-fighting-crime-better-than-the-cops/" rel="noopener noreferrer nofollow">Meet the onchain crypto detectives fighting crime better than the cops</a>

Crypto phishing losses fell 83% in 2025, but drainer ecosystem ‘remains active’

Table of Contents

Cointelegraph

Other articles published on Jan 3, 2026

Join our free newsletter for daily crypto updates!