In 2025, crypto wallet-draining phishing scams caused about $83.85 million in losses, an 83% drop from roughly $494 million in 2024, according to Scam Sniffer's annual analysis. The number of impacted wallets fell to around 106,000 and average losses slid to about $790 per victim, even as attackers shifted toward smaller, more frequent thefts and exploited new vectors like Permit signatures and EIP-7702. Security experts say the decline likely reflects better wallet defenses and user tools, but warn that phishing tactics continue to evolve alongside market cycles.

On Sunday, SlowMist said it detected a potential critical vulnerability affecting HitBTC and went public on X after direct messages under responsible disclosure received no response. The firm urged the exchange to contact them to coordinate next steps. SlowMist's 2025 report logged 12 exchange-related incidents causing up to USD 1.809 billion in losses.

South Korea's Financial Intelligence Unit approved only two new virtual asset service providers in 2025, down from four in 2024. The average approval timeline increased to 16 months from 11, and VASPs filed 36,684 suspicious transaction reports between January and August 2025, with about 90% tied to illegal cross-border remittance schemes.

On 4 January 2026, Scam Sniffer reported that wallet-draining phishing schemes on Ethereum-compatible networks stole about $84 million in 2025, with roughly 106,000 wallets impacted. Losses declined sharply from the prior year as market activity cooled, while attackers shifted toward more frequent, lower-value campaigns and quickly exploited new Ethereum features such as EIP-7702 after the Pectra upgrade.

On-chain investigator ZachXBT reported hundreds of MetaMask users across multiple EVM networks had small balances siphoned by a phishing campaign, with aggregate losses surpassing $107,000. Victims typically approved malicious contracts after a MetaMask-themed email, and revoking allowances via MetaMask Portfolio, Revoke.cash, or Etherscan's approvals tools can help limit further exposure.

PeckShield reported that December 2025 crypto exploit losses fell 60% from November, totaling $76.2 million across 26 incidents. The largest case was a $50 million address‑poisoning scheme, followed by a $27.3M multisig breach and $8.5M stolen via a trojanized Chrome extension.

On January 3, ScamSniffer reported a phishing theft involving a malicious "permit" signature that drained roughly $1.08 million in aEthLBTC from a crypto user. The attackers allegedly had the victim sign via a phishing site or cloned dApp, then swiftly converted the assets to ETH and routed funds through Tornado Cash. SlowMist's founder Cosine noted the group is not among mainstream drainers.

On January 3, 2026, CYFIRMA detailed Android/BankBot‑YNRK, a trojan spreading through counterfeit Google News apps and aiming at more than 60 banking and finance apps across Vietnam, Singapore, Malaysia, India and Indonesia. The malware exploits accessibility services to automate transactions, capture screen content and harvest credentials, with crypto wallets such as MetaMask, Exodus and Trust Wallet also listed as at risk.