Crypto Phishing Statistics 2026: Losses by Year and Method
Quick answer. ScamSniffer puts wallet drainer phishing at $494 million in 2024 and $83.85 million in 2025. CertiK, counting every phishing incident it tracks, reports $1.05 billion and $722.9 million, then $366.3 million in the first half of 2026.
Video transcript
Phishing needs no bug. A victim signs a message or sends a transfer, and the attacker does the rest.
Annual totals depend on who counts. ScamSniffer, tracking wallet drainers, reports 494 million dollars in 2024 and 83.85 million in 2025. CertiK, counting all phishing, reports 1.05 billion and 722.9 million.
ScamSniffer's drainer losses fell 83 percent in 2025. It says harder-to-track attacks, like targeted social engineering, may explain part of the drop.
CertiK sees the same shift. In the first half of 2026, four targeted attacks made up about 85 percent of its phishing losses.
Most large drainer thefts come from one signature. Permit led in 2024 and 2025, followed in 2025 by approvals, transfers and new EIP-7702 batch signatures.
Address poisoning plants a lookalike address and waits for a copy-paste. One study found 270 million onchain attacks over two years on Ethereum and BNB Smart Chain.
Every loss shares one step: a person approved without checking fully. So decode every signature, refuse permits you did not start, pay only from a verified address book, and alert on treasury approvals.
Guardian's OpSec audit reviews what signers actually see before approving. Managed Security monitors multisig transactions and your domains, with an engineer responding when something fires.
Read the full article for every figure and source, or talk to Guardian about your signing controls.
Phishing needs no bug. The victim signs a message or sends a transfer, and the attacker does the rest.
For 2025, CertiK's phishing total is nearly nine times ScamSniffer's, by our calculation. Each source counts something different.
This page collects the figures by year and method, with what each source counts and when it published. All were read on November 6, 2026.
What Each Source Counts
| Source | What it counts | Latest figures |
|---|---|---|
| ScamSniffer | Wallet drainer phishing sites, EVM chains only | 2025, published Jan 3, 2026 |
| CertiK | Phishing as an attack vector, any victim | H1 2026, published Jul 6, 2026 |
| Chainalysis | Personal wallet compromises; scam revenue | 2025, published Dec 2025 and Jan 2026 |
| FBI IC3 | US complaints that mention cryptocurrency | 2025, published April 2026 |
ScamSniffer calls its figure a lower bound, valued at the time of theft. It excludes direct hacks, exchange compromises and contract exploits.
CertiK's phishing class is wider: in 2024, it had three phishing incidents of over $100 million each.
Annual Phishing Losses
| Period | ScamSniffer (drainers) | CertiK (phishing) |
|---|---|---|
| 2023 | $295M, 324,000 victims | Not covered here |
| 2024 | $494M, 332,000 victims | $1.05B, 296 incidents |
| 2025 | $83.85M, 106,106 victims | $722.9M, 248 incidents |
| H1 2026 | No half-year figure found | $366.3M, 63 incidents |
ScamSniffer's drainer losses rose 67% in 2024, then fell 83% in 2025, and victims fell 68%.
ScamSniffer ties losses to market activity. It says part of the drop may reflect a shift to harder-to-track attacks, such as targeted social engineering.
CertiK's phishing losses fell 31% in 2025, by our calculation. Phishing was still its most frequent attack vector that year.
In 2026, CertiK counts fewer but larger cases. Phishing incidents fell 52.3% from 132 in H1 2025, while phishing losses fell only 10.8%.
CertiK describes a shift to highly targeted social engineering attacks. Four of them made up about 85% of its H1 2026 phishing losses.
Share of all losses
- 2024: phishing was 44% of CertiK's total losses.
- 2025: 22%. Supply chain was the costliest vector, $1.45 billion in two incidents.
- H1 2026: 28%, behind wallet compromise at $444.5 million.
Shares are our calculation from CertiK's own totals. For hacks by year, see our crypto hack statistics.
Wider views: Chainalysis and the FBI
Chainalysis does not break out phishing. It counts personal wallet compromises from any cause: $1.5 billion in 2024 and $713 million in 2025.
That was 20% of all value stolen in 2025, across 158,000 incidents and at least 80,000 victims, it says.
Scams are larger again. Chainalysis says scams received at least $14 billion onchain in 2025, and the total could exceed $17 billion.
The FBI's IC3 logged $11.366 billion in 2025 losses from complaints mentioning cryptocurrency, up 22% from 2024.
Phishing and spoofing were a small slice: 7,164 complaints and $111.0 million, about 1% of those losses by our calculation.
Investment fraud was by far the largest category.
Permit and Approval Phishing
Most large drainer thefts come from one signature. ScamSniffer breaks its largest cases down by signature type.
| Signature type | 2024 share | 2025 share |
|---|---|---|
| Permit (with Permit2 in 2025) | 56.7% | 38% |
| setOwner | 31.9% | Not listed |
| Approve or increaseAllowance | 3.5% | 24% |
| Transfer | 4.5% | 21% |
| EIP-7702 batch | Not listed | 11% |
| setApprovalForAll | Not listed | 5% |
- Shares cover only cases of $1 million or more, not all losses.
- 2024: 30 such cases, $171 million. 2025: 11 cases, $22.98 million.
- 2024's other types made up 3.4%. 2025 shares other than Permit are our calculation.
Permit was the dominant type in both years. A permit is a signature, not a transaction.
EIP-7702 is the new entry. ScamSniffer says malicious EIP-7702 signatures appeared after Ethereum's Pectra upgrade, with two large cases in August 2025 worth $2.54 million.
Our guide to Permit2 phishing decodes a malicious request field by field.
Drainer Kits
ScamSniffer's losses come from wallet drainers, the scripts behind phishing sites. It tracks the leading families each year.
- 2023: Inferno, MS and Pink.
- First half of 2024: Angel 42%, Pink 28%, Inferno 22%. Pink announced its exit in May.
- Q4 2024: Inferno and Angel 45% together, Acedrainer 20%, new drainers 25%.
- 2025: "new drainers emerged," with none named.
Victims lost less each in 2025. ScamSniffer's average was $790 per victim, down from $1,488 in 2024 and $910 in 2023.
Largest Single-Victim Losses
The largest individual losses here came from two methods: a bad signature, or a payment to a lookalike address.
| Date | Loss | Method | Outcome |
|---|---|---|---|
| May 2024 | 1,155 WBTC, about $68M | Address poisoning | About $65.7M returned May 10 |
| Aug 2024 | $55.48M in DAI | setOwner signature | Not stated |
| Dec 20, 2025 | 49,999,950 USDT | Address poisoning | Swapped, then sent to Tornado Cash |
| Sep 2025 | $6.5M in stETH and aEthWBTC | Permit signature | Not stated |
Sources: CoinDesk and Cointelegraph for May 2024, The Block for December 2025, ScamSniffer for the rest.
ScamSniffer's largest single theft was $24.05 million in 2023, $55.48 million in 2024 and $6.5 million in 2025.
Address poisoning at scale
Address poisoning plants a lookalike address in a victim's history and waits for a copy-paste.
A USENIX Security 2025 study measured it over two years on Ethereum and BNB Smart Chain. It found 270 million onchain attacks targeting 17 million victims.
It counted 6,633 incidents in which a victim paid a lookalike, with at least $83.8 million lost.
Test transfers do not stop it. In the December 2025 case, a 50 USDT test went to the right address 26 minutes before the loss, The Block reported.
See our guide to address poisoning attacks for the treasury controls.
Defenses for Teams and Treasuries
The losses above share one step: a person approved a signature or a payment without checking it fully. Make that check hard to skip.
Signing
- Decode every signature request into token, spender, amount and expiry.
- Refuse Permit, Permit2, setOwner and EIP-7702 requests you did not start.
- Sign exact amounts with short expirations. Never unlimited, long-lived permits.
- Simulate first, on a device the signer controls.
- On treasury wallets, two people check every signature, not just transactions.
Payments
- Pay only to a verified address book. Never copy from history.
- Enforce an allowlist in your custody policy.
- Compare the full address on the signing device.
Monitoring and response
- Alert on approvals, permits and delegations from treasury addresses.
- Review and revoke standing approvals on a schedule.
- Keep issuer and exchange freeze contacts ready.
If funds are already gone, follow our checklist for the first hour after a wallet drain.
How Guardian Helps
An OpSec audit reviews how transactions are proposed, checked and signed.
It looks at what a signer actually sees before approving, and what it takes to slip a malicious payload past them.
Managed Security monitors your contracts on every block, including multisig transactions and large fund movements.
Offchain, it watches your domains, DNS and certificates. When something fires, a Guardian engineer responds.
Frequently Asked Questions
How much is lost to crypto phishing each year?
ScamSniffer counts wallet drainer losses of $295 million in 2023, $494 million in 2024 and $83.85 million in 2025, on EVM chains. CertiK, which counts every phishing incident it tracks, reports $1.05 billion in 2024 and $722.9 million in 2025.
Why did crypto phishing losses fall in 2025?
ScamSniffer's drainer total fell 83% and its victims 68%. It ties losses to market activity, and says harder-to-track attacks, such as targeted social engineering, may explain part of the drop. CertiK's phishing losses fell 31%, by our calculation.
What is the most common signature in crypto phishing?
Permit. ScamSniffer names it the dominant signature type in large drainer cases in 2024, at 56.7% of large-case losses, and in 2025, at 38% with Permit2.
How much do Americans report losing to crypto phishing?
In 2025, the FBI's IC3 logged 7,164 phishing and spoofing complaints that referenced cryptocurrency, with $111.0 million in losses. All complaints referencing cryptocurrency reported $11.366 billion.
Sources
- ScamSniffer: Scam Sniffer 2025, Crypto Phishing Losses Fall 83% to $84 Million (January 3, 2026)
- ScamSniffer: Scam Sniffer 2024, Web3 Phishing Attacks: Wallet Drainers Drain $494 Million (January 3, 2025)
- CertiK: Hack3d, The Web3 Security Report 2024 (January 2, 2025)
- CertiK: Hack3d, The Web3 Security Report 2025 (December 23, 2025)
- CertiK: Hack3D, H1 2026 Report (July 6, 2026)
- Chainalysis: North Korea Drives Record $2 Billion Crypto Theft Year (December 18, 2025)
- Chainalysis: Record $17 Billion Estimated Stolen in Crypto Scams and Fraud in 2025 (January 13, 2026)
- FBI IC3: 2025 IC3 Annual Report (PDF, April 2026)
- USENIX Security 2025 (arXiv): Blockchain Address Poisoning (revised July 2, 2025)
- CoinDesk: Exploiter Steals $68M Worth of Crypto Through Address Poisoning (May 3, 2024)
- Cointelegraph: WBTC address poisoner sends nearly all funds back to victim after negotiations (May 10, 2024)
- The Block: Crypto trader loses $50 million in address poisoning attack, offers $1 million bounty for return (December 20, 2025)
Make every signature your team approves readable
Guardian reviews how your signers check what they approve, then watches your treasury and multisigs around the clock.