Crypto Thieves Shift Focus to Phishing as Protocol Hacks Decline in February

Bybit prevented over $300 million in unauthorized withdrawals during the last quarter of the previous year, highlighting the crisis in crypto thefts for February.

Key Takeaways

Significant Losses: In February, nearly $50 million was stolen in cryptocurrency thefts, a sharp decline from January's $385 million.
Phishing Rise: Social engineering scams, particularly phishing attacks, have increased and now represent a major threat, exploiting human errors.
Major Incident: A single hack of Step Finance accounted for approximately $30 million of the losses in February.
Ongoing Vulnerability: Despite improvements in security, the threat of scams targeting individual users remains a serious concern within the industry.

Crypto

According to security firm Nominis, nearly $50 million was stolen across the cryptocurrency sector last month, a small fraction compared to what Bybit blocked in just three months.

Human Error Becomes Target for Attackers

While the drop from January’s $385 million in thefts may seem like a positive development, security experts indicate a more critical narrative emerges when examining the source of these attacks.

Social engineering scams, which deceive individuals into giving away access to their accounts, inflicted more significant damage in February compared to traditional software vulnerabilities. Phishing attacks surged during this period, with fraudsters sending harmful messages intended to trick users into clicking on dangerous links or unwittingly signing transactions.

Phishing Attack

The predominant method employed was authorization abuse, where victims were misled into granting wallet permissions without truly understanding their implications. Once these permissions were granted, attackers could freely transfer funds, targeting private users rather than exchanges or larger protocols.

Unauthorized Withdrawal

Major Breach Contributes to Most Losses

A single incident was responsible for a significant portion of February's losses. Step Finance, a portfolio analytics platform on the Solana blockchain, was compromised, resulting in the theft of around $30 million. Excluding this event, February would have been notably quieter compared to previous months.

Supporting this view, blockchain security firm PeckShield reported February losses reached $26.5 million, marking the lowest monthly figure since March 2025. PeckShield attributed this reduction partly to enhanced risk management and improved security practices within the industry.

Bitcoin Trading BTCUSD trading at $69,268 on the 24-hour chart: TradingView

Even though February proved to be a calmer month, the annual impact of such thefts remains concerning. Data from Chainalysis indicates that crypto hacks cost the sector $3.4 billion last year, illustrating that there is still a considerable amount of work to be done before these thefts can be regarded as under control.

Bybit's internal reports illustrate the extent of the active work necessary to combat these threats. The exchange noted that its fraud detection systems identified approximately 350 high-risk addresses and prevented around 8,000 users from potentially falling victim to scams — all within just one quarter.

Reports suggest that while large protocol attacks are declining, the increase in scams targeting everyday users indicates that criminals are merely shifting their focus. Although improvements in smart contract audits and more robust on-chain monitoring are closing certain vulnerabilities, the potential for individuals to be misled into approving incorrect transactions keeps another avenue of risk open.

Featured image from Trillium Mutual Insurance, chart from TradingView