EVM Wallet-Drainer Phishing Losses Fell to $83.85M in 2025

Tracked wallet-drainer phishing on Ethereum Virtual Machine (EVM)-compatible chains accounted for $83.85 million in losses across 106,106 victims in 2025, according to the tally. Dollar losses fell 83% from $494 million in 2024, while the victim count declined 68% from 332,000. Both measures moved in the same direction, but the dollar contraction was larger.

• Average loss: $790 per victim.
• Highest quarter: Q3, with $31.04 million.
• Large cases: 11 losses of at least $1 million.
• Largest case: $6.5 million, involving a Permit signature in September.

The figures indicate broad improvement across the measured category, not the disappearance of high-value fraud. Eleven cases reached at least $1 million each, so a falling aggregate did not remove concentrated losses. Plainly, the tally counted fewer victims and less money, while a small group still faced seven-figure losses.

How do wallet-drainer phishing attacks work?\n

Wallet-drainer phishing relies on persuading users to sign harmful transactions, including token approvals and Permit signatures. On Ethereum, a wallet functions as an interface for an account whose funds are recorded on the network, while the account’s private key signs transactions. A site connection can let that site see the wallet’s public address and on-chain holdings.

A site connection and a token approval authorize different actions. Under the ERC-20 standard, an approval permits a designated spender to withdraw tokens up to a specified allowance. A phishing request can induce a user to sign either that approval or a Permit signature, so its effect depends on the exact terms presented.

The source is precise about the mechanism: the request’s effect “depends on what it asks the wallet to authorize.” The September $6.5 million case, which involved a Permit signature, confirms that the tracked category extends beyond standard ERC-20 approvals, although the source provides no transaction-level breakdown.

Operationally, users must inspect the authorization requested rather than treat every wallet prompt as equivalent. The practical distinction is simple: connecting a site and allowing it to spend tokens are separate permissions.

What does the tally actually measure?\n

The tally covers only trackable wallet-drainer phishing activity across EVM-compatible chains. It excludes direct hacks, exchange compromises and smart-contract exploits, and it does not capture unreported incidents. Those exclusions prevent a direct comparison with broader crypto-theft totals.

The methodology calls the figure a “lower-bound estimate of wallet-drainer phishing losses, not a total for crypto theft.” That qualification matters because lower measured losses do not establish that underlying attack activity fell by the same 83%. The aggregate data does not identify the operators or explain which changes produced the decline.

Separately, the source records an Ethereum phishing-signature loss involving $303,000 in aEthWETH. It does not state whether that incident sits inside the annual tally, so adding $303,000 to the headline figure would be unsupported.

The takeaway is narrow: the report measures a defined and incomplete slice of crypto fraud.

What can users do after a suspicious signature?\n

Users who suspect a scam can revoke token approvals. Disconnecting a site and revoking an on-chain allowance are separate actions, and the source does not treat disconnection as a substitute for revocation. Confirmed Ethereum transactions cannot be reversed, so prevention at the signature prompt carries more weight than remediation afterward.

For wallets and applications, that creates a clear operational distinction: permission to view an address and holdings differs from permission to spend tokens. Wallets and applications therefore need separate controls for site connections and token allowances, rather than relying on a single connection status.

In plain terms, users should inspect the request and revoke what was granted without expecting the original transaction to disappear. For the wallet market, the forward-looking operational change is clear: present site disconnection and allowance revocation as distinct security actions, because one does not cancel the other and confirmed Ethereum transactions cannot be reversed.