Wallet Drainer Phishing Losses Plummet to $84M in 2025, Marking an 83% Decline

Crypto phishing attacks associated with wallet drainers have seen a dramatic decrease in 2025, with total losses dropping to $83.85 million. This represents an 83% reduction from nearly $494 million recorded in the previous year.

Key Takeaways:

Wallet drainer phishing losses decreased by 83% in 2025, but attackers continue to be active and adapt their strategies.
Phishing incidents have surged during market rallies, with Ethereum’s notable increase in Q3 leading to the highest losses of the year.
Permit-based approvals and the new EIP-7702 exploits are ongoing risks for cryptocurrency users.

The latest report from Scam Sniffer, a Web3 security platform, indicates that the number of impacted users has also decreased, totaling around 106,000—a 68% reduction from the previous year.

These findings reveal a significant slowdown in one of the most persistent threats in the crypto space, with fewer victims and reduced total losses, even as attackers sharpen their techniques.

Wallet Drainer Phishing Losses Fall to $84M in 2025, Down 83%

Phishing Losses Correlate with Market Fluctuations

Despite the considerable decline, the report warns that phishing attacks have not vanished. Instead, these incidents correspond closely with fluctuations in the broader cryptocurrency market.

Periods of increased on-chain activity are typically followed by spikes in phishing attacks, while calmer market phases see a reduction in losses.

The third quarter of 2025, aligned with Ethereum’s most substantial rally, saw the highest losses, totaling $31 million. Notably, August and September contributed nearly 29% of the annual losses.

Scam Sniffer characterized phishing risk as a “probability function of user activity,” suggesting that higher trading volumes increase the pool of potential targets.

Monthly losses varied significantly, ranging from a mere $2.04 million in December, the quietest month, to $12.17 million in August, when trading surged.

The largest individual theft recorded in 2025 involved $6.5 million in September, linked to a malicious Permit signature.

Permit and Permit2 approvals remained potent tools for attackers, representing 38% of losses in cases exceeding $1 million. This data indicates that approval-based exploits continue to be a significant danger, especially for users engaging with unfamiliar applications.

The report also pointed out emerging attack methods. Following Ethereum’s Pectra upgrade, attackers began exploiting EIP-7702-based malicious signatures, allowing multiple harmful actions to be included in a single user approval.

Two incidents in August, where such malicious methods led to $2.54 million in losses, highlight how quickly attackers can adapt to changes in protocols.

Shift in Phishing Tactics: From Large Gold Mines to Targeting Retail Users

In 2025, large-scale attacks became less common, with only 11 incidents exceeding $1 million, falling from 30 the previous year. Instead, attackers appeared to pivot toward more frequent, lower-value campaigns targeting smaller victims.

The average loss per victim decreased to $790, indicating a shift toward retail users rather than high-profile individual thefts.

An example cited involved an attacker draining small amounts from numerous crypto wallets across Ethereum Virtual Machine (EVM) compatible networks, as onchain investigator ZachXBT described, representing a wider, lower-value operation.

While individual losses were generally capped at under $2,000 per wallet, the extensive nature of the operation suggests a coordinated tactic rather than singular breaches.

Meanwhile, losses related to hacks and cybersecurity breaches in the crypto space drastically decreased in December, reducing by 60% month-on-month to approximately $76 million.