Crypto Phishing Losses Plunge 83% - Security Renaissance or Just a Lull?

Crypto's biggest predators just got a massive haircut. Phishing losses across the digital asset space have cratered—down a staggering 83%.

The Anatomy of a Collapse

For years, phishing was the low-hanging fruit for crypto thieves. Fake wallets, spoofed exchanges, and social engineering drained billions from unsuspecting users. The playbook was simple, and it worked. Now, that playbook is getting shredded.

Defense Goes on the Offensive

What changed? The industry stopped playing defense. Wallet providers baked transaction simulations directly into their interfaces—showing users exactly what they're signing before they sign. Major exchanges deployed AI-driven threat detection that flags malicious links in real-time, often before a user even clicks. Community-led watchdog groups have turned blockchain sleuthing into a public sport, doxxing scam operations faster than they can rebrand.

It's a layered defense, and it's cutting off the oxygen to phishing campaigns. The 'spray and pray' email blasts? Mostly ineffective. The fake MetaMask support Twitter accounts? Instantly suspended. The infrastructure of fraud is getting expensive to maintain.

A Cynical Pause or a Permanent Shift?

Let's be real—in finance, every lull in crime just means the crooks are working on a better, quieter scam. Maybe this 83% drop just means they've moved onto more sophisticated social engineering, or are waiting for the next bull market's fresh crop of 'wen lambo' hopefuls. After all, a traditional banker would call this 'cost of doing business' and move on.

But the data doesn't lie. An 83% plunge is a seismic shift. It signals that the crypto ecosystem is maturing beyond its 'wild west' phase. Users are savvier. Tools are sharper. The cost of attempting a scam is going up, while the success rate is plummeting.

This isn't just good news—it's critical infrastructure. For crypto to go truly mainstream, it needs to be safe. A dramatic drop in one of its most persistent plagues proves that safety isn't a pipe dream. It's being built, block by block, right now. The phishers are on the back foot. Let's make sure they never recover.

Crypto market valuation declines ‘sends away’ phishing scammers

Per Scam Sniffer’s analysis and chart data tracking the first quarter, when markets were declining, losses stood at $21.94 million, affecting slightly over 22,000 victims. When markets began to recover in the second quarter, phishing losses declined to $17.78 million from about 21,000 victims.

The third quarter was the most dangerous period for market participants because several assets had witnessed strong rallies, including Bitcoin, which peaked at $123,000, and Ethereum, which hit its all-time-high price at $4,946 in August. The price charge and bull market environment came with a surge in phishing activity, pushing losses to $31.04 million and impacting 40,000 victims. 

August and September alone accounted for 29% of total annual losses, making the quarter the most active for attackers. However, the last quarter of the year saw a pullback in phishing losses that fell to $13.09 million, by far the quietest part of 2025. 

Permit / Permit2 leads signature phishing theft methods 

The biggest single phishing theft last year resulted in a $6.5 million loss in September, where hackers made away with staked ether and Wrapped Bitcoin derivatives. The attackers used a method known as the Permit-style signature, a feat that made up 38% of losses among cases exceeding $1 million. 

Permit/Permit 2 signatures allow token spending approvals without direct transfers, which attackers take advantage of by disguising malicious permissions to appear as legitimate prompts and trick token holders into accepting them without question.

Other cases included a $3.13 million theft of wrapped Bitcoin in May using an approval escalation technique, and a $3.05 million loss of stablecoins in August through a direct transfer exploit. Yet, only 11 cases exceeded $1 million in the year, down from 30 the year before.

The data also showed a decline in the average loss per victim, which fell to $790, down from nearly $1,500 last year.

While the report focused on signature-based wallet drainer attacks, one of the most unforgettable cases occurred in February, when the Lazarus Group compromised a developer machine through a multisignature wallet provider within the Bybit crypto exchange. A malicious code was injected into a signing interface, enabling attackers to spoof legitimate approvals and steal approximately $1.46 billion.

Supply chain attacks were also among the most prevalent methods used, with attackers stealing developer credentials through phishing emails and injecting malicious code into open-source packages, backdooring hundreds of software libraries, and exfiltrating private information and security credentials.

Other campaigns phishing hackers used included compromised front-end interfaces, hijacked social media accounts, and spreading malware to steal private keys and authentication data. 

2025 closed with Google Task notification phishing abuse

In other news, the year ended with a sophisticated email phishing campaign in December, as hackers targeted more than 3,000 organizations in manufacturing by abusing Google’s cloud-based infrastructure.

Several users reported receiving emails that appeared as genuine task notifications, prompting recipients to complete an urgent “All Employees Task.” Victims who clicked buttons labeled “View task” or “Mark complete” were redirected to malicious pages hosted on trusted cloud storage services.

Because the messages were sent using legitimate application integration tools, they passed all major email authentication checks and walked past security gateways undetected. 

The smartest crypto minds already read our newsletter. Want in? Join them.