Signature Phishing Surges 200% in January, Over $6M Stolen
By John Nada·Feb 9, 2026·6 min read
January saw a 200% spike in signature phishing, with over $6M stolen. Despite this rise, 2025 phishing losses were significantly lower than 2024.
Signature phishing incidents skyrocketed by more than 200% in January, with losses exceeding $6.27 million, according to blockchain security firm Scam Sniffer. A staggering 4,700 wallets were drained during the month, marking a 207% increase from December. This alarming trend highlights a growing vulnerability in the crypto space as scams evolve and become more sophisticated.
Despite the spike in January, total phishing losses for 2025 were significantly lower than in 2024. Scam Sniffer reported total losses of $83.85 million across 106,106 victims last year, reflecting an 83% decrease in value and a 68% reduction in victims compared to the previous year. This decline suggests that while signature phishing is on the rise, broader phishing activities may be diminishing as users become more aware and cautious.
The increase in signature phishing has been attributed to more attractive phishing tactics, particularly following Ethereum's Fusaka upgrade. Researchers noted that cheaper Ethereum fees have made tactics like mass address poisoning more appealing for scammers. In January alone, two wallets accounted for about 65% of the total stolen through various phishing attacks, highlighting the concentrated nature of these scams.
Signature phishing involves luring users to malicious decentralized applications that prompt them to sign off-chain messages. These requests may seem benign, asking for approvals on token deposits or NFT listings. However, users unknowingly authorize unlimited token spending or NFT transfers, leading to wallet drainages. A notable case involved an individual losing $12.25 million by copying the wrong address from their transaction history, illustrating the potential consequences of these tactics.
In December, another victim experienced a staggering loss of $50 million in a similar manner, underscoring the significant financial impact that signature phishing can have. The combined losses from just two incidents in December and January highlight the severe risks associated with this scam, with a total of $62 million vanished due to mere mistakes in address copying. Such alarming figures indicate an urgent need for enhanced user education and awareness in the cryptocurrency space.
In addition to signature phishing, Scam Sniffer identified address poisoning and permit scams as significant contributors to the rise in phishing losses. Address poisoning occurs when attackers send small transactions, or dust, to targets using addresses that closely resemble legitimate ones. This tactic increases the likelihood that users will mistakenly send funds to an attacker-controlled address.
Following the Fusaka upgrade, the dynamics of address poisoning have shifted. Researchers observed a surge in new address creations, with one week seeing 2.7 million new addresses—170% above typical levels. Furthermore, about two-thirds of these new addresses received less than $1 in stablecoins as their first transaction, indicating a potential for large-scale address poisoning campaigns. This data suggests that the methods employed by scammers are adapting and becoming more insidious as the cryptocurrency ecosystem evolves.
The reduced costs of sending millions of dust transactions have made mass poisoning attacks more viable, with profits originating from a small number of costly mistakes by users. While the conversion rates for these scams remain low, the sheer volume of transactions makes the strategy appealing for scammers. The economic landscape of phishing scams is changing, and with the right conditions, scammers can exploit even the slightest user error for substantial gains.
To combat these rising threats, wallet providers are implementing new features to enhance security. Tara Annison, head of product at Twinstake, mentioned that wallet developers are increasingly adding transaction simulations, clearer warnings, and pre-execution checks. Such features aim to flag risky interactions and prevent users from signing malicious transactions. This proactive approach is essential as the threat landscape continues to evolve.
Rabby, for instance, utilizes pre-execution simulations to alert users when interacting with known malicious smart contracts. Similarly, Metamask provides prominent warnings if the site a user is connecting to appears suspicious. These proactive measures are becoming essential as the threat landscape evolves, but they also rely on users being aware and informed about the potential risks they face.
In light of these developments, it's crucial for users to remain vigilant and verify transactions thoroughly. Understanding what they are signing or where they are sending money can significantly reduce the risk of falling victim to these scams. The prevalence of scams like signature phishing serves as a reminder that even as technology advances, human error remains a significant vulnerability in the cryptocurrency ecosystem.
Decrypt reached out to the Ethereum Foundation for comments regarding these rising phishing incidents, but details were not immediately available. As the landscape of crypto scams shifts and evolves, the industry must adapt to safeguard users and their assets from these persistent threats. The complexity and rapid changes in the crypto environment mean that both users and developers must stay ahead of potential risks, ensuring that security is prioritized as the technology grows.
The ongoing situation with phishing attacks highlights the critical need for both individual vigilance and collective industry action. Users should engage in best practices such as double-checking addresses, utilizing wallet features designed to enhance security, and staying informed about the latest phishing tactics. On a broader scale, the cryptocurrency community must continue to collaborate on better security protocols and user education initiatives to mitigate the risks associated with phishing and other scams.
As phishing schemes become increasingly sophisticated, the responsibility to protect one's assets falls more heavily on the user. The rise of signature phishing is not just a statistic but a wake-up call for the entire crypto community to enhance their defenses against such threats. The data presented by Scam Sniffer reveals not only the scale of the problem but also the evolving nature of scams in the digital currency world, underscoring the importance of proactive security measures.
The surge in signature phishing incidents serves as a critical reminder of the need for ongoing vigilance in the crypto space. As new phishing tactics emerge, users must adapt their strategies and practices to safeguard their assets. The responsibility lies with both the individual and the industry to ensure that security measures keep pace with the evolving threat landscape. Continuous education, awareness, and technological advancements will be crucial in combating the rise of phishing and protecting users from devastating losses in the future.