Phishing and cryptocurrency: record scams and new techniques you should know

Crypto-related phishing is reaching historic levels in 2025, with new strategies and exploits especially dangerous for users of Ethereum, Bitcoin and DeFi platforms. In August alone, victims lost more than 12 million dollars to attacks that were increasingly automated and difficult to detect, according to recent figures from specialized firms such as Scam Sniffer and Wintermute. If you have digital assets, this is essential reading to protect yourself from the most current and sophisticated threats.

‍

Why is there a phishing boom in the crypto market?

• The volume of cryptocurrency phishing scams rose by 72% in August alone, with more than 15,000 wallets affected worldwide.
• Much of the problem: new technical features of Ethereum, such as EIP-7702, which allows attackers to trick users into signing transactions on malicious smart contracts, without them being aware of it.
• In addition, advanced “scam-as-a-service” tools—such as Vanilla Drainer—offer professional kits for launching massive phishing campaigns, with technical support and a commission for stealing each scamming “customer”.

‍

Main phishing techniques used in cryptocurrency in September 2025

• Smart Contract Phishing/EIP-7702: Fraudulent requests to “improve” or update the wallet lead to the signing of unlimited permissions.
• False commission refunds (Ethereum gas refunds): Messages that offer to return “gas fees” trick you into connecting your wallets to malicious websites using legitimate protocols such as WalletConnect.
• Phishing on developers and open source code: Email attacks against npm package maintainers to take control of libraries that are used in millions of wallets and crypto apps, inserting malware that steals funds in the browser.
• Scam-as-a-service tools: Platforms that allow any cybercriminal to launch their phishing campaign in a matter of minutes, with infrastructure and even support included.

‍

How to protect your cryptocurrencies and wallets from phishing?

• Verify domains and URLs before connecting any wallet or signing requests.
• Avoid “prizes”, “airdrops”, refunds or sudden offers that require connecting your wallet or approving unknown permissions.
• Don't sign transactions that you don't fully understand and you're wary of any urgent attempts.
• Always keep your software, wallets and web extensions up to date.
• Use multifactor authentication where possible and monitor your movements with security analysis tools.
• For developers: review open source dependencies and package updates with extreme rigor.

‍

🛡️ Request your personalized consultancy with Apolo Cybersecurity and protect your crypto-investment today

Crypto phishing evolves with the market and technology: new Ethereum features, large scale strategies and professional tools have increased risk and losses. Anticipation, education, and vigilance are your best defense against next-generation crypto scams.

Do you want to audit the security of your digital assets or train your team to identify attacks?

‍