Phishing Campaigns in 2026: Inside the Crypto Kill Chain

The crypto phishing business had a strange year. By the headline numbers it looks like an industry in retreat. Wallet drainers stole roughly $84 million from about 106,000 victims across Ethereum and other EVM chains in 2025, down 83 percent from the $494 million peak of 2024, according to Scam Sniffer. Fewer people clicked, fewer wallets emptied, and the charts pointed down. Then the same dataset told a second, more unsettling story. The money did not leave. It concentrated.

In January 2026, signature phishing losses jumped 207 percent month over month to $6.27 million, and just two wallets accounted for roughly 65 percent of everything stolen that month, Scam Sniffer told Decrypt. The nets got smaller and the fish got bigger. Behind that shift sits an operation that has quietly professionalized: ready-made drainer kits rented to affiliates, hijacked blue-check accounts turned into megaphones, and malware that sits patiently on a laptop until there is something worth taking.

This piece takes apart the modern phishing campaign as an operation, from the kit economy that supplies the code through the lure, the distribution, the fatal signature, and the laundering that follows. The techniques have proper names now, approval phishing, address poisoning, EIP-7702 delegation, ClickFix, and each one maps to a stage in a repeatable kill chain. Learning to see that chain is the difference between clicking and closing the tab.

The Numbers Behind the 2026 Shift

Three years of data trace an attack class that scaled, overshot, and then narrowed its aim. In 2023, Scam Sniffer counted about $300 million drained from roughly 320,000 victims. In 2024 the money nearly doubled to $494 million, a 67 percent jump, even though the victim count barely moved. The average theft grew because attackers started landing bigger individual hits; the firm logged 30 cases above $1 million that together accounted for $171 million, including a single theft of $55.48 million.

Then 2025 reversed the trend. Losses fell 83 percent to about $84 million and victims dropped 68 percent to 106,106. Two forces drove the decline. Several major drainer crews publicly wound down or rebranded, and wallet software got much better at flagging dangerous signatures before a user approved them. The volume collapsed. The ambition did not. Attackers responded by hunting whales, where one compromised account can out-earn a thousand small drains, a pattern the January 2026 spike made impossible to ignore.

Zoom out and the drainer numbers look like a rounding error. Chainalysis estimated that crypto scams and fraud of all kinds pulled in a record $17 billion in 2025, boosted by AI-generated lures. In the United States alone, the FBI’s Internet Crime Complaint Center tied $9.3 billion in 2024 losses to crypto, up 66 percent year over year, with Americans aged 60 and older absorbing $2.8 billion of that total. On-chain wallet draining is only the visible tip.

Drainer-as-a-Service: Theft Gets an Affiliate Program

The reason an amateur scammer can run a campaign that looks like it came from a professional shop is that, increasingly, it did. Drainer-as-a-service, or DaaS, splits the work into two roles. A developer maintains the malicious code, the phishing-page templates, and a dashboard that tracks takings in real time. Affiliates handle the hustle: building lure sites, buying ads, hijacking accounts, and chasing victims. The developer takes a cut, commonly around 20 percent of each theft and rising toward 30 percent when the operator also supplies the phishing site, and the affiliate keeps the rest.

Inferno Drainer is the case study. It announced a shutdown in late 2023, yet Check Point Research found it quietly back in business, draining more than $9 million from over 30,000 wallets in a six-month stretch. The rebuilt kit leans on single-use smart contracts that self-destruct after one transaction, on-chain encrypted configurations, and proxy-based command-and-control, all designed to dodge the blacklists wallet software checks against. Before the relaunch, operators had reportedly handed part of the operation to a rival, Angel Drainer, while copycats such as Pink Drainer and MS Drainer kept the same kit-and-affiliate template alive.

The model is not limited to Ethereum. On Solana, Google’s Mandiant tracked a DaaS drainer it named ClinkSink, used by at least 35 affiliate identities across 42 wallet addresses to steal no less than $900,000, with affiliates taking a roughly 20 percent cut. The lure pages impersonated real projects such as Bonk, DappRadar, and Phantom, promising airdrops and hosting JavaScript that emptied any wallet that connected. One kit, many brands, dozens of operators: that is the shape of the supply side.

What makes this an economy and not just a toolkit is the service layer around it. Kits are marketed in Telegram storefronts with feature lists, changelogs, and uptime promises; some offer customer support for affiliates and take requests for new target integrations. Reputation matters, because an affiliate shopping for a kit wants one that evades the latest wallet warnings, so developers compete on stealth the way legitimate software competes on speed. The result is a feedback loop: defenders ship a detection, kit authors ship an update, and the cycle repeats on a timescale measured in days.

Stage One: Engineering the Lure

Every campaign starts with a pretext that gets a funded wallet onto a malicious page. The catalog is wide and it rotates with whatever the market is excited about. Fake airdrop and token-claim pages are the workhorses. Around them sit cloned decentralized exchange front-ends, counterfeit NFT mint sites, bogus staking and restaking dashboards, and, with grim irony, fake revoke-your-approvals tools that are themselves drainers. When a hot narrative appears, the lures follow within hours.

Getting the lure to look official is mostly a domain game. Attackers register lookalike domains, swap a letter or a top-level domain, and poison search results so the fake outranks the real site. Paid ads do the rest; a sponsored result sitting above the genuine link converts frighteningly well, because users trust the top of the page. Cross-chain bridges are a favorite target, since bridge interfaces are unfamiliar enough that users expect odd prompts, which is exactly why a careful risk playbook for bridging crypto treats every bridge front-end as something to verify rather than trust.

The best lures are not generic. They ride real events: a token generation event, an exchange listing, a chain upgrade, or an outage that leaves users anxious and looking for a fix. A pretext built on something the victim already believes is happening does most of the persuading before a single malicious byte loads, which is why campaigns cluster around the busiest days on the calendar rather than quiet ones.

Stage Two: Distribution at Scale

A lure is worthless until it reaches wallets with money, and distribution is where campaigns borrow other people’s trust. Hijacked verified accounts on X are the loudest channel; attackers phish or brute-force their way into a corporate, government, or project handle and post a fake mint or airdrop link to an audience that assumes the source is legitimate. In one widely reported case, intruders brute-forced the X account of security firm Mandiant itself in January 2024 and used it to push a drainer link, a compromise the company attributed to two-factor authentication not being fully enabled during a team transition.

Beyond account takeovers, the distribution toolkit includes Discord and Telegram server compromises, Google Calendar invites that smuggle links past email filters, reply-bot swarms under genuine announcements, and old-fashioned advertising. The through line is social proof. A blue check, an official logo, or a trusted server name does the persuading, so the victim arrives at the malicious page already primed to connect a wallet. By the time anything looks wrong, the request to sign is already on screen.

Paid search is its own front. Attackers buy ads against high-intent queries, the name of a wallet, a bridge, or an exchange support line, so the first result a worried user sees is a trap. Fake support numbers and chat widgets turn panic into disclosure, and malvertising networks can serve a clean page to reviewers and the malicious one to everyone else. Because the ad sits above organic results and carries the platform’s implicit endorsement, it often beats the real site on the exact day a user is most likely to make a mistake.

Stage Three: The Signature Trap

The kill is a signature, not a password. There is nothing to steal by force because the victim authorizes the theft. Three families of request do the damage. The first is the token approval: an ERC-20 approve or, for NFTs, a setApprovalForAll that hands a spender permission to move assets, often with an unlimited allowance. Security people call this ice phishing, and the malicious allowance can sit dormant for weeks before the sweep, which is what makes stale approvals so dangerous.

The second, and now dominant, family is the off-chain signature. A single gasless message under EIP-2612 Permit or Uniswap’s Permit2 grants a contract the right to transfer a user’s tokens, and because it is just a signed message, it leaves no on-chain trace until the attacker chooses to execute it. Wallets historically rendered these as harmless, which is exactly why they worked. Scam Sniffer reported that malicious Permit and Permit2 signatures remained the leading drainer method through 2025, outpacing on-chain approvals. The third family is the blunt one: a direct transfer or a batched contract call disguised as a claim.

The only real defense at this stage is reading the request: the spender address, the token, and the amount. The trouble is that most wallet prompts were, until recently, close to unreadable, and a user who cannot tell a router from a drainer will click approve either way. The sharp improvement in those prompts is a large part of why 2025’s volume fell, and the attackers’ pivot to a handful of high-value targets is the direct response.

Address Poisoning: Weaponizing Your Own History

Some campaigns never ask you to sign anything. They let you rob yourself. Address poisoning exploits a human habit: copying a destination address from your own transaction history instead of retyping it. The attacker generates a vanity address whose first and last characters match an address you use often, then plants a tiny or zero-value transfer so it appears in your history right next to the real one. Days later, in a hurry, you copy the wrong line.

The textbook case came in May 2024, when a trader sent 1,155 wrapped Bitcoin, worth about $68 million, to a lookalike address after the attacker seeded the victim’s history with a spoofed 0.05 ETH transfer. Investigators later tied more than 82,000 addresses to the same campaign, and in that rare instance the thief negotiated and returned the funds. Most victims are not so lucky. Scam Sniffer told Decrypt the tactic is still landing nine-figure damage in aggregate: “Someone lost $12.25M in January by copying the wrong address from their transaction history. In December, another victim lost $50M the same way.” The fix is unglamorous: keep an address book, send a small test amount first, and never trust a string you copied from history.

EIP-7702 and the New Delegation Surface

Ethereum’s Pectra upgrade introduced EIP-7702, which lets an ordinary wallet temporarily delegate control to a smart contract so it can batch actions and smooth the user experience. Useful features make useful weapons. Attackers use phishing to get a victim to sign a delegation that points the account at a sweeper contract, and from that moment any funds arriving in the wallet can be forwarded automatically.

Researchers quickly noticed that a single reused sweeper, nicknamed CrimeEnjoyor, sat behind the vast majority of malicious delegations. Trading firm Wintermute found that more than 97 percent of EIP-7702 delegations pointed at copies of the same contract and built a public tool to flag the bytecode. The reassuring footnote, for now, is that Wintermute reported the scheme has been largely unprofitable, because it mostly mops up wallets whose keys were already compromised rather than tricking fresh victims. The worry is structural: delegation is a new kind of prompt that almost nobody understands, and the signing surface only grows as smart accounts spread.

ClickFix and the Malware Crossover

Not every campaign ends at a signature. Some end with malware, and the fastest-growing delivery trick of the past two years is ClickFix. It disguises a malware command as a routine verify-you-are-human step: a fake CAPTCHA tells the user to copy a string and paste it into the Terminal or the Windows Run box, which quietly launches PowerShell or a scripting host to pull down the real payload. MITRE added the technique to its ATT&CK catalog in March 2025, and Microsoft reported that it now sees ClickFix-style attacks hitting thousands of enterprise and consumer devices every day, with detections up more than fivefold between the second half of 2024 and the first half of 2025.

For crypto holders the payload is often a stealer with a wallet-draining function. Researchers at Huntress traced a macOS strain back to a ClickFix lure and found it could siphon Bitcoin, Litecoin, Dogecoin, Ethereum, and XRP, and that it was built to take a configurable share of a wallet rather than empty it, a quieter approach that delays discovery. Infostealers in this class also harvest seed phrases from notes, keystore files from disk, and session data from browser wallet extensions. When malware has your keys, no signature is required at all.

Supply-Chain Phishing: One Developer, Thousands of Victims

The highest-leverage phishing target is not a wealthy user. It is a developer whose code runs in thousands of browsers. The clearest example remains the Ledger Connect Kit incident of December 14, 2023. A former employee was phished, the attacker used the access to publish malicious versions 1.1.5 through 1.1.7 of a widely used connector library to npm, and because many decentralized apps loaded that library from a content delivery network, the drainer began executing in end-user browsers within minutes. BleepingComputer reported that attackers drained more than $600,000 in a window of roughly five hours before the poisoned package was replaced.

The same logic drives a steady stream of attacks on software registries and code hosts: phished maintainer accounts, typosquatted packages, and malicious pull requests that slip a tainted dependency into a trusted build. Phishing one credential at the top of a software supply chain converts a product that millions trust into a delivery vehicle for a drainer. For the end user there is almost no defense in the moment, which is why so much of the industry’s hardening effort has moved upstream to the people who ship the code, and why clear-signing on a hardware device matters even when the front-end looks perfect.

The Human Exploit: Support Desks, Fake Jobs, and Deepfakes

The most expensive campaigns of the cycle skipped the browser entirely and went after the person. Support impersonation is the sharpest tool. On August 19, 2025, on-chain investigator ZachXBT reported that a victim lost 783 BTC, about $91 million at the time, after attackers posed as customer support for both an exchange and a hardware-wallet maker. The victim “fell for a social engineering scam,” he wrote, after “exchange and hardware wallet customer support were impersonated,” as CoinDesk reported, with the funds quickly peeled off toward a mixer. A separate case he traced involved roughly 3,520 BTC taken from an elderly American and laundered through several exchanges into Monero.

The recruitment angle is just as dangerous. Attackers linked to North Korea pose as recruiters, walk targets through a fake interview, and ask them to run a coding-test repository that is actually malware, or to join a video call where a deepfaked executive adds pressure. We covered that playbook in depth in our report on crypto spear-phishing and fake interviews. The common ingredient is urgency plus authority, applied to an asset that cannot be clawed back once it moves.

Deepfakes have moved the con from text to live video. Cloned voices and synthetic faces let an attacker stage a call from a colleague, an auditor, or a project’s own leadership, adding a layer of authority no phishing email ever had. For a treasury signer or an exchange employee, a convincing video request to approve a transfer or paste a diagnostic command can be far more persuasive than any website, which is why internal controls that require out-of-band confirmation have become a frontline defense rather than a compliance checkbox.

A Field Guide to Today’s Campaigns

The techniques above recur in different combinations, but each has a signature shape. The table maps the main campaign types to how a victim is hooked, what they actually authorize, and the single most effective defense.

The people who trace this money for a living describe a convergence rather than a single trick. Chainalysis has documented how approval phishing fused with long-con romance fraud, the scheme often called pig butchering, estimating that the pairing cost victims at least $1 billion from 2021 to 2023, with one approval-phishing wallet alone taking $44.3 million from thousands of victims. The lure is no longer a drive-by link; it is a relationship built over weeks that ends with a signature.

MetaMask security researcher Taylor Monahan, who has reconstructed a long list of thefts against experienced users, keeps returning to blast radius. Her widely shared advice is blunt: “PLEASE DON’T KEEP ALL YOUR ASSETS IN A SINGLE KEY OR SECRET PHRASE FOR YEARS,” she wrote, urging holders to split funds across wallets, keep the bulk behind a hardware wallet, and move savings off any account that stays connected to the internet, as recounted in a CoinDesk column. The message from both camps is the same: you cannot out-click a professional, so you shrink what a single mistake can cost.

Regulators, Law Enforcement, and the Long Odds of Recovery

For United States victims, the front door is the FBI’s Internet Crime Complaint Center, which logged that record $9.3 billion in crypto-related losses for 2024 across nearly 150,000 complaints. The SEC pursues the securities-fraud dimension when a scheme dresses itself up as an investment, and FinCEN’s rules govern the exchanges where stolen funds try to cash out. Public-private efforts have started to bite at the edges; Chainalysis ran an initiative called Operation Spincaster that identified thousands of approval-phishing victims and worked with exchanges and investigators across several countries to disrupt the cash-out.

The hard truth is that recovery is the exception. Once funds are bridged across chains, run through a mixer, or swapped into a privacy coin, tracing slows and seizure becomes unlikely. The $68 million wrapped-Bitcoin return happened only because the thief chose to negotiate. Worse, a second wave of fraud preys on the freshly robbed, with fake fund-recovery services that charge an upfront fee and vanish. Reporting fast matters, because the rare wins depend on an exchange freezing funds before they move, but the realistic posture is prevention, not clawback.

Hardening Your Wallet Against the Next Campaign

Defense is less about one clever setting and more about shrinking blast radius and slowing yourself down at the exact moment attackers want speed. A practical checklist:

• Keep long-term holdings on a hardware wallet, in a separate address from the hot wallet you use for daily interactions. A guide to choosing one, from Ledger, Trezor, and Tangem, is worth reading before you move serious value.
• Read every signature request. Check the spender address, the token, and the amount, and refuse anything you did not personally initiate.
• Treat Permit and Permit2 prompts as high risk, and periodically revoke stale token allowances with a trusted revocation tool.
• Keep an address book, verify the full destination address, and send a small test amount before any large transfer.
• Bookmark official sites and reach them directly. Do not click sponsored search ads, airdrop links, or wallet prompts sent by direct message.
• Never paste a command from a web page into your terminal or the Run box, no matter how convincing the verification screen looks.
• Use app-based or hardware two-factor authentication, never SMS, and assume any support agent who contacts you first is an impostor.
• Keep your operating system, browser, and wallet extensions updated, and treat unexpected job offers, coding tests, and video calls as hostile until proven otherwise.

The Outlook: Where Campaigns Go Next

The direction of travel is clear enough. Generative AI is already personalizing lures and cloning voices, a core reason Chainalysis flagged a record scam haul for 2025. Expect more whale-hunting, more support-desk theater, and more attempts to phish the developers upstream of everyone else. The defensive counterweight is improving too: transaction simulation, clear-signing on hardware, allow-listing, and sharper wallet warnings are closing the gap that made 2024 so profitable.

Two frontiers will shape the next few years. The first is automation. As AI agents gain the ability to hold keys and sign on a user’s behalf, the question of which agent you are actually trusting becomes a security problem in its own right, a theme we explore in our look at on-chain identity and trust. The second is the human-versus-bot arms race playing out in account takeovers and mass distribution, where proposals to prove a real person is behind an action collide with privacy, as we discuss in why proof of human is not KYC. The headline losses may keep falling while the stakes per victim keep climbing. In that world, the only durable edge is the discipline to read what you sign and to keep the bulk of your money where a single bad click cannot reach it.

Frequently Asked Questions

What is a crypto phishing campaign?

A crypto phishing campaign is an organized operation that tricks wallet owners into approving transactions, signing messages, or handing over credentials so attackers can drain their funds. Modern campaigns are often run as a service, with developers supplying the drainer code and phishing templates while affiliates bring the traffic and split the proceeds.

How do wallet drainers steal funds if I never share my seed phrase?

Most drainers never need your seed phrase. They get you to sign a token approval or an off-chain Permit message that grants a malicious contract the right to move your assets, then sweep your wallet in a later transaction you never see.

What is approval phishing and a Permit signature scam?

Approval phishing tricks you into granting a spender an allowance over your tokens, often an unlimited one, through an ERC-20 approve or an NFT setApprovalForAll. A Permit or Permit2 scam does the same thing with a single gasless signature that leaves no on-chain trace until the attacker cashes it in, which is why wallets historically failed to flag it.

Can crypto stolen in a phishing attack be recovered?

Usually not. Once funds are bridged, mixed, or swapped into a privacy coin such as Monero they are effectively gone, and law enforcement recovers only a small share. Report the theft to the FBI’s IC3 and the relevant exchange immediately, because the rare recoveries depend on freezing funds before they move.

How can I protect my wallet from phishing in 2026?

Keep long-term holdings on a hardware wallet in a separate address from the one you use for daily activity, and read every signature request for the spender, token, and amount before approving. Bookmark official sites instead of clicking ads or direct messages, never paste commands from a web page into your terminal, and treat unsolicited support contact, job offers, and recruiter calls as hostile.

By the HOGE Wire security desk, covering wallet exploits, scams, and on-chain forensics.