Crypto Phishing Scams Surge, Costing Industry $1.2 Million in March

In March, address poisoning scams, a type of cryptocurrency phishing attack, resulted in the loss of over $1.2 million. These scams involve tricking victims into sending their digital assets to fraudulent addresses that mimic legitimate ones. The scammers send small transactions to victims, mimicking their frequently used wallet addresses. When users copy-paste an address from their transaction history, they might accidentally send funds to the scammer instead.

Address poisoning scams have been on the rise since the beginning of the year, with the industry losing over $1.8 million in February. The growing sophistication of attackers and the lack of pre-transaction security measures are some of the main reasons for the increase. More users and institutions are leveraging automated tools for crypto transactions, some of which may not have built-in verification mechanisms to detect poisoned addresses.

While the higher transaction volume due to the crypto bull market is a contributing factor, pre-transaction verification methods may stop a significant amount of phishing attacks. Unlike traditional fraud detection, many wallets and platforms lack real-time pre-transaction screening that could flag suspicious addresses before funds are sent.

Address poisoning scams have previously cost investors tens of millions. In May 2024, an investor sent $71 million worth of Wrapped Bitcoin to a bait wallet address, falling victim to a wallet poisoning scam. The scammer created a wallet address with similar alphanumeric characters and made a small transaction to the victim’s account. However, the attacker returned the $71 million days later, after he had an unexpected change of heart due to the growing attention from blockchain investigators.

Phishing scams are a growing problem for the crypto industry, next to traditional hacks. Pig butchering scams are another type of phishing scheme involving prolonged and complex manipulation tactics to trick investors into willingly sending their assets to fraudulent crypto addresses. Pig butchering schemes on the Ethereum network cost the industry over $5.5 billion across 200,000 identified cases in 2024. The average grooming period for victims lasts between one and two weeks in 35% of cases, while 10% of scams involve grooming periods of up to three months. In an alarming sign, 75% of victims lost over half of their net worth to pig butchering scams. Males aged 30 to 49 are most affected by these attacks.

Phishing scams were the top crypto security threat of 2024, which netted attackers over $1 billion across 296 incidents as the most costly attack vector for the crypto industry. The increasing prevalence of these scams highlights the need for enhanced security measures and user education to protect against such threats. The lack of real-time pre-transaction screening and the growing sophistication of attackers are significant challenges that the industry must address to mitigate the risk of address poisoning scams.