Phishing-related crypto losses fell for the third consecutive month in February, with 7,442 victims losing $5.32 million, according to data from Scam Sniffer.
The security firm reported that this represents a significant 48% decline from January’s $10.25 million and December 2024’s $23.58 million.
The blockchain firm pointed out that the downward trend suggests that crypto users are becoming more security-conscious, taking proactive steps to safeguard their funds.
Additionally, the fewer incidents indicate a growing awareness of common scams and improved security practices across the industry.
Major phishing attacks
The most significant attack in February involved address poisoning on the Ethereum network, where scammers manipulated transaction histories to trick users into sending funds to fraudulent addresses. This method accounted for $771,000 in stolen assets.
Other phishing tactics also led to substantial losses. Permit-related exploits drained $611,000 from Ethereum users, while BNB Chain users lost $610,000 due to unrevoked approvals. Additionally, “Increase Approval” scams stole $326,000 from Ethereum wallets.
One notable case involved a victim who lost $607,000 due to a phishing approval signed over a year ago.
Considering this, analysts at Scam Sniffer advised users to revoke outdated approvals when network fees are low to reduce exposure to such attacks.
Sophisticated phishing schemes
Despite the decline in phishing losses, scammers continue refining their tactics.
Scam Sniffer warned about a Telegram-based scheme in which attackers lure users into entering verification codes, ultimately hijacking their accounts.
The firm explained how the attack works:
- Scammers send a message urging the victim to “verify” an issue.
- The victim enters a login code.
- Attackers steal session information.
- The victim loses access to their Telegram account.
- Once inside, they search for private keys or impersonate the victim to deceive their contacts.
Scam Sniffer warned that these tactics are becoming more widespread, with attackers frequently using fake security alerts to manipulate users.
