Phishing tied to trackable wallet-drainer activity on Ethereum Virtual Machine (EVM)-compatible chains accounted for $83.85 million in losses in 2025, affecting 106,106 victims as the tally fell sharply from the prior year.
Dollar losses were down 83% from $494 million in 2024, when the tally counted 332,000 victims. The number of victims fell 68%. Eleven cases in 2025 had losses of at least $1 million. The largest, at $6.5 million, involved a Permit signature in September.
The average loss was $790 per victim. Q3 recorded the highest quarterly total, at $31.04 million.
The tally covers trackable wallet-drainer phishing activity on EVM-compatible chains. These attacks trick users into signing harmful transactions, including token approvals and Permit signatures. The figures exclude direct hacks, exchange compromises and smart contract exploits, and do not capture unreported incidents. They are a lower-bound estimate of wallet-drainer phishing losses, not a total for crypto theft.
On Ethereum, a wallet is an interface for using an account whose funds are recorded on the network. The account’s private key signs transactions. Connecting a site can let it see a wallet’s public address and on-chain holdings.
A site connection and a token approval are separate permissions. Under the ERC-20 standard, an approval can authorize a designated spender to withdraw tokens up to a specified allowance. A phishing request can trick a user into signing an approval or a Permit signature, so the request’s effect depends on what it asks the wallet to authorize.
Users who suspect a scam can revoke token approvals. Disconnecting a site and revoking an on-chain allowance are separate actions, and confirmed Ethereum transactions cannot be reversed.
A separate Ethereum phishing-signature loss involved $303,000 in aEthWETH.
Simon Yoon
Simon Yoon reports on blockchain technology for TokenPost. Send corrections or tips to [email protected].
