By 2025, the year-over-year cryptocurrency phishing loss has dropped by 83%, but the "wallet emptier" ecosystem remains active

On January 3, Web3 security platform Scam Sniffer reported that crypto phishing losses tied to wallet drainers fell to roughly $83.85 million in 2025—plunging 83% from nearly $494 million in 2024. The number of victims dropped to 106, a 68% year-over-year decrease. However, the report noted phishing hasn’t gone away—it’s highly tied to market cycles. In Q3 2025, as Ethereum staged a strong rebound, phishing losses hit a yearly high of $31 million, making up nearly 29% of the full year’s total. December saw the lowest monthly loss (~$2.04 million), while August had the highest ($12.17 million). In terms of tactics, Permit/Permit2 authorization phishing remains attackers’ most effective tool. The biggest single case of 2025 occurred in September, with losses reaching $6.5 million. Additionally, after Ethereum’s Pectra upgrade, a new malicious signature attack tied to EIP-7702 quickly emerged, causing $2.54 million in losses across two August incidents. Notably, large-scale cases dropped sharply: only 11 cases in 2025 had losses over $1 million, down from 30 in 2024. But attackers have shifted to a “small-scale, high-frequency” strategy, with average losses per victim falling to $790. Scam Sniffer concluded: “The drainer ecosystem is still active—old players exit, new ones keep popping up.” Separately, PeckShield data shows that in December 2025, losses from crypto hacks and security incidents totaled ~$76 million—down 60% from the prior month—but attacks remain frequent.