What are the crypto phishing statistics for 2026?

How much did crypto scams take in 2025?

Chainalysis counted at least $14 billion received by scams on-chain in 2025 and expects the total to pass $17 billion. The estimate rises over time because analysts attach more wallets to scam operations after the first count. The revised figure for 2024 was about $12 billion.

Two details matter for a project's domain. Impersonation scams, where the criminal poses as a known brand, person or service, grew about 1,400% year over year, and the average amount stolen per impersonation scam rose by more than 600%. The average scam payment went from $782 in 2024 to $2,764 in 2025. A look-alike of a protocol's site is an impersonation by definition.

The FBI's Internet Crime Complaint Center reported about $11.37 billion in crypto-related fraud losses for 2025, on 181,565 complaints, according to Decrypt's coverage of the report. That is a count of complaints made by victims, mostly in the United States, so it measures a different thing than Chainalysis's on-chain count.

How much do wallet-drainer phishing sites steal?

ScamSniffer counted $83.85 million lost to wallet-drainer phishing sites in 2025, down 83% from $494 million in 2024. The number of victims fell 68%, from 332,000 to 106,106. The report covers only phishing websites that drain wallets on EVM chains, and it describes its totals as a lower bound.

The largest single theft was $6.5 million through a Permit signature in September. Permit and Permit2 signatures made up 38% of the losses in large cases, and EIP-7702 batch signatures appeared after the Pectra upgrade. August was the worst month at $12.17 million; December the smallest at $2.04 million.

One warning on attribution: some outlets credited the $83.85 million figure to SlowMist. It comes from ScamSniffer. SlowMist's own 2025 report gives about $2.935 billion in losses across about 200 incidents, calls phishing one of the most active vectors, and publishes no phishing total.

How many phishing attacks and domains are there?

APWG logged 1,069,681 phishing attacks in the second quarter of 2026, 10.1% more than the 971,181 of the first quarter. June 2026 alone reached 425,808, the highest month since April 2023. APWG counted 941 unique brands attacked in the quarter, and the SaaS and webmail sector took 29.1% of attacks. The quarterly report text does not give a crypto share, so we do not quote one.

On the domain side, Interisle found more than 1.5 million phishing domains between May 2024 and April 2025, 38% more than a year earlier, and 77% of them had been registered by criminals, the rest being compromised or otherwise acquired. By extension, the following year's data put .com first with 869,180 phishing domains; the full ranking is in which domain extensions are most used for phishing.

Why do the reports give different totals?

The totals differ because each publisher counts a different thing. ScamSniffer counts losses to phishing-site drainers on EVM chains. Chainalysis counts on-chain revenue of scam operations. CertiK counts security incidents, with phishing as one of several vectors: 248 phishing incidents and about $723 million out of about $3.35 billion in 2025, according to a press summary of its Hack3d report. The FBI counts complaints filed by victims.

A fair reading uses each figure for what it measures. Drainer losses show how much leaves wallets through fake sites. Impersonation growth shows how often criminals pose as someone else. APWG and Interisle show how many pages and domains exist to do it. None of them says how much a single project lost, and none replaces your own monitoring.

We left out Immunefi's loss reports and any share of crypto in APWG's totals: we could not verify a figure.

What do these figures mean for a project's domains?

They mean that the attack on your users usually starts with a domain, and that the domains are cheap to register. A phishing page needs a name that resembles yours; 77% of the phishing domains Interisle studied were bought for the purpose. Your name in the endings phishers use costs less per year than a single complaint at the arbitration centres: the defensive core set of .com, .net, .org, .io, .xyz and .app is $128.94 a year at Wardmint, and a WIPO complaint for one to five domains costs USD 1,500.

The second half of the defence is a response plan. The guide to reporting a phishing domain lists who to contact, and the pillar guide on protecting a crypto project from phishing domains puts registration, hardening, monitoring and response in order.

Wardmint registers names; it does not monitor or take sites down.

How many sources does this page rely on?

According to Wardmint's index of 12 November 2026, this page draws on 7 publishers (Chainalysis, ScamSniffer, CertiK, SlowMist, the FBI IC3, APWG and Interisle). Five were read on the publisher's own page; two, CertiK and the FBI IC3, were read through press coverage because the original could not be loaded. Each row of the table says which.

A citable summary: the 2025 crypto-scam total is a Chainalysis estimate of at least $14 billion on-chain; the 2025 wallet-drainer loss is a ScamSniffer count of $83.85 million; and the 2026 phishing volume is an APWG count of 1,069,681 attacks in one quarter.