Cryptocurrency investors lost approximately $300 million to phishing scams in 2023, according to a comprehensive annual report released by Web3 security firm Scam Sniffer. The staggering figure, drawn from nearly 324,000 confirmed victims, underscores a sobering reality: as the crypto market surges past a $1.7 trillion total capitalization, the threat landscape evolves just as rapidly. Bitcoin trading near $45,000 and Ethereum above $2,350 have drawn millions of new participants into the space — and sophisticated cybercriminals are waiting for them.
The Threat Landscape
Phishing attacks in the crypto space have undergone a dramatic transformation. Gone are the days of crude email scams asking for wallet seeds. Today’s threat actors deploy malware known as “Wallet Drainers” — malicious software embedded in fraudulent websites that trick users into signing transactions that drain their wallets of every asset.
Scam Sniffer’s report identifies several prominent Wallet Drainer operations that dominated 2023. Inferno Drainer looted an astonishing $81 million over just nine months, far surpassing Monkey Drainer, which stole $16 million across six months of activity before its operator shut down following exposure by blockchain investigator ZachXBT. Other active drainers included MS Drainer, Angel Drainer, Venom Drainer, Pink Drainer, and Pussy Drainer — each responsible for millions in losses.
The most devastating single day occurred on March 11, 2023, when nearly $7 million was stolen in 24 hours. Victims encountered phishing websites impersonating Circle, the issuer of USDC stablecoin. Another spike coincided with the hacking of Arbitrum’s official Discord server on March 24, demonstrating how attackers exploit trusted community channels to distribute malicious links.
These phishing operations generate revenue through a drainer fee model — typically around 20% of stolen funds. With collective losses approaching $300 million, the operators of these services profited at least $47 million simply by selling access to their malicious tools.
Core Principles
Protecting yourself against phishing attacks requires adherence to a few fundamental security principles. The first and most critical is verifying the source. Every link you click should be scrutinized. Bookmark official websites and access them directly rather than following links from social media, Discord messages, or unsolicited emails. Attackers routinely compromise official project accounts on Discord and X (formerly Twitter), meaning even links from seemingly legitimate channels can be dangerous.
The second principle is understanding that anyone asking you to connect your wallet on an unfamiliar site is likely attempting to steal your funds. Wallet Drainers work by prompting users to sign a transaction — often disguised as a claim, verification, or airdrop — that grants the attacker permission to transfer assets out. Before signing any transaction, carefully review what permissions you are granting.
The third principle is skepticism toward unsolicited opportunities. Airdrops of non-fungible tokens (NFTs) appearing in your wallet are a common attack vector. These NFTs often contain links to phishing websites. Do not interact with unexpected tokens or follow links embedded in them.
Tooling & Setup
Several tools and practices can significantly reduce your exposure to phishing attacks. Hardware wallets remain the gold standard for cryptocurrency storage. By keeping your private keys offline, devices like Ledger and Trezor ensure that even if your computer is compromised, an attacker cannot access your funds without physical possession of the device.
Browser extensions such as Scam Sniffer’s own tool can identify known malicious websites in real time. Scam Sniffer reported scanning nearly 12 million URLs throughout 2023 and identifying approximately 145,000 malicious addresses. Their open-source blacklist contains close to 100,000 dangerous domains and is continuously updated.
For advanced users, consider running transactions through a simulation tool before signing. Services like Tenderly or wallet-integrated simulators can show you exactly what a transaction will do before you approve it, revealing any unexpected token transfers or approvals.
Enable multi-factor authentication on all exchange accounts and use dedicated, secure email addresses for your crypto activities. Consider using a separate browser profile exclusively for cryptocurrency transactions to reduce the attack surface from general web browsing.
Ongoing Vigilance
Security is not a one-time setup — it requires continuous attention. The phishing landscape evolves rapidly. When one drainer operation shuts down, another takes its place. After ZachXBT exposed Monkey Drainer in early 2023, Venom Drainer quickly absorbed its client base. When Venom ceased operations in April, new providers filled the void.
Stay informed by following reputable blockchain security researchers on social media. Accounts like ZachXBT and Scam Sniffer regularly post alerts about active phishing campaigns. Report suspicious websites and communications to organizations like Chainabuse, which works with security firms to take down malicious infrastructure.
Regularly audit your wallet’s token approvals. Many users inadvertently grant permanent spending approvals to smart contracts, creating an ongoing vulnerability. Tools like Revoke.cash allow you to review and revoke unnecessary approvals across multiple chains.
Final Takeaway
The $300 million stolen through phishing in 2023 represents real losses from real people — over 324,000 of them. As Bitcoin holds above $44,900 and the broader crypto market enters what many expect to be a transformative year, the incentive for attackers will only grow. The tools and knowledge to protect yourself exist. Use them. Verify every link, question every transaction, and never assume that because a message comes from an official channel, it is safe.
Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always conduct your own research and consult with security professionals regarding your specific situation.
the $300M figure is probably low. how many victims never report because they are too embarrassed
324,000 victims in one year and people still connect wallets to random sites they found on twitter. smh
324k victims and crypto twitter still posts “GM” threads with wallet connect links every morning. people dont learn
the Inferno Drainer alone took $81M. these are not amateur operations anymore, they are full businesses
wallet drainers evolved faster than the security tools meant to stop them. Inferno Drainer was basically a SaaS platform for theft
the fix is simple: revoke approvals after every swap. people just cant be bothered to spend 30 seconds onrevoke.cash
revocation_maxi_ revoke.cash takes 30 seconds and costs like 50 cents in gas. no sympathy for people who skip it honestly
revoke after every swap is the move. sad part is most people learn it only after the drainer already got them
DrainerHunter calling it a SaaS platform is dead on. Inferno had customer support, documentation, and revenue sharing. industrialized theft
Inferno Drainer having customer support and docs is the most dystopian thing. they literally productized wallet theft
docs and a support desk for theft, wild. probably better SLAs than half the legit protocols ive used lol
wallet drainers as a service with rev share models. the $300M is probably half the real number too
Lena V. rev share models means the drainer devs make more than the victims lose on any given day. insane incentive structure
Lena V. the rev share model is the part that should alarm everyone. drainer devs have quarterly revenue targets now. this is a proper industry.
324k victims averaging under $1000 each. thats retail getting picked off in amounts too small to bother reporting
the average victim lost under $1000. small enough that most wont bother with police reports or chain analysis. drainers designed the perfect crime vector
Filip M. jurisdiction shopping works both ways. drainer affiliates route withdrawals through mixers precisely so the sub-1000 losses never aggregate into a number any prosecutor would touch
Filip M. the sub-thousand average is exactly why law enforcement ignores it. institutional-grade phishing kits sold on telegram for 50 bucks a month.
revoke_or_bled 50 bucks a month in kit costs against 81M taken by inferno. the roi on theft beats every legit startup pitch, grim stuff
cold wallet for holds, burner hot wallet with 200 bucks for approvals. the drainer can only take what exists on that address, cap the blast radius and sleep fine
Grant F. burner wallet with 200 bucks is criminally underrated. i sign every random approval from mine and sleep fine, blast radius of a firecracker
burner wallet gang. a 200 dollar hot wallet is basically the whole security model in one move, sad how few people actually run it
burner_wallet_bo the firecracker line is right but the hard part is habit. moved everything to a ledger and the hot wallet still crept back up to 2k within a month because convenience always wins
300 million across 324,000 victims works out to under a grand per person. Nobody files a report at that size, which is exactly why the drainer shops keep operating at scale.
exactly, under a grand per victim and half of them cant even figure out which jurisdiction to report to. the math is designed for silence
324k victims in a year and wallet apps still show a permission prompt half of users cannot parse. the UX gap between sign and understand is doing more damage than the drainer kits
Scam Sniffer data only catches on-chain drainer signatures. social engineering pre-drainer wallets gets missed entirely. $300M is a floor estimate.