Scam Sniffer’s 2025 anti-scam report says wallet drainer phishing on EVM chains eased sharply this year, with total losses falling to $83.85 million from $494 million in 2024. The number of victims also dropped to 106,106. The decline was real, but it was not steady through the year. Once market activity picked up, losses rose fast, and the third quarter turned into the costliest period.
Annual totals dropped across key measures
On a yearly basis, phishing damage fell 83% and victim count declined 68%. The report ties that shift to stronger wallet warnings, improved detection systems, and better user awareness. The largest single theft also came down sharply, reaching $6.5 million in 2025 versus more than $55 million in 2024. Average loss per victim fell to $790, showing that the impact of each incident became less severe on average.
Losses rose with market momentum
Quarterly figures tracked trading conditions closely. Losses were $21.94 million in Q1 and $17.78 million in Q2, then jumped to $31.04 million in Q3, nearly 37% of the annual total. Q4 cooled to $13.09 million. Monthly data showed the same pattern. December posted the lowest loss at $2.04 million, while August recorded the highest at $12.17 million. August and September together made up almost 30% of the year’s losses.
Permit signatures remained central in major thefts
Only 11 phishing cases exceeded $1 million in 2025, with combined losses of $22.98 million. The biggest incident came in September, when a Permit signature attack led to a $6.5 million loss. Scam Sniffer said Permit and Permit2 signatures accounted for 38% of major losses, keeping permit-based approvals at the center of high-value phishing activity.
New Ethereum upgrade opened a fresh attack route
The report also flagged new attack methods tied to Ethereum’s Pectra upgrade, especially around EIP-7702. In August, two EIP-7702 batch-signature attacks caused a combined $2.54 million in losses. That points to a shift in attacker behavior. Broad, noisy campaigns became less dominant, while more technical methods and higher-value targets gained importance.
Scam Sniffer added that these figures focus on wallet drainer phishing and do not cover harder-to-track threats such as private key theft, malware, or supply chain compromises. Within the scope of the report, phishing did not disappear in 2025. It became more selective, more technical, and much more sensitive to bursts of market activity.