In January, a series of wallet-related mistakes and increasingly sophisticated phishing attacks caused cryptocurrency users to lose a combined $62 million, highlighting once again that human error remains one of the weakest links in Web3 security.
According to data from Web3 security platform Scam Sniffer, the losses were primarily driven by address poisoning attacks and signature phishing schemes, both of which exploit user behavior rather than technical vulnerabilities.
🧠 User Mistakes and the Surge in Phishing Attacks
One of the most striking incidents occurred in January, when a crypto user accidentally lost $12.25 million after copying the wrong wallet address. This followed a similar case in December, where another user lost nearly $50 million due to the same mistake.
Combined, these two incidents alone account for the majority of the $62 million in reported losses.
Scam Sniffer also reported a sharp rise in signature phishing attacks during January:
$6.27 million stolen
4,741 victims affected
A 207% increase compared to December
Some of the largest phishing-related losses included:
$3.02 million involving SLVon and XAUt (Tether Gold) through malicious permit and increaseAllowance approvals
$1.08 million stolen from aEthLBTC via a permit signature
Notably, just two wallets accounted for nearly 65% of the total phishing-related losses during the month.
🎯 How Address Poisoning Attacks Work
Address poisoning is a social-engineering attack where scammers send small transactions from wallet addresses that closely resemble a victim’s real address.
These fake addresses often:
Share the same first and last characters
Appear legitimate in transaction history
Trick users into copying the wrong address when making future transfers
Once the victim unknowingly sends funds to the poisoned address, the assets are transferred directly to the attacker, with little chance of recovery.
✍️ Signature Phishing: A Silent but Deadly Threat
Signature phishing further amplifies risk by deceiving users into signing malicious approval transactions. These signatures may grant attackers permission to:
Spend tokens at any time in the future
Drain wallets without additional confirmation
Because these attacks rely on user authorization, even experienced crypto holders can fall victim—especially when interacting with fake websites, impersonated dApps, or misleading pop-ups.
💥 $3 Million PYTH Loss Due to a Fake Wallet Address
A notable case from November last year involved a crypto holder who lost over $3 million worth of PYTH tokens after sending funds to a fake wallet address.
Blockchain analysts at Lookonchain revealed that:
The attacker created a wallet matching the first four characters of the victim’s real deposit address
A small SOL transaction was sent to the victim to make the address appear legitimate
The victim later transferred 7 million PYTH tokens without double-checking the full address
At the time of the transaction, the stolen PYTH tokens were valued at approximately $3.08 million.
🛡️ Safe Warns of Large-Scale Address Poisoning Campaign
In response to the growing number of incidents, Safe (formerly Gnosis Safe), a leading non-custodial multisig wallet provider, issued a warning about a large-scale address poisoning and social engineering campaign.
Safe disclosed that attackers had:
Created thousands of fake Safe wallet addresses
Targeted multisig wallets to trick users into transferring funds to malicious addresses
Importantly, Safe emphasized that:
There was no protocol vulnerability
No issues with infrastructure or smart contracts
To mitigate risks, Safe:
Identified and flagged approximately 5,000 malicious addresses
Removed them from the Safe Wallet interface to reduce the likelihood of accidental transfers
⚠️ Final Thoughts
These incidents serve as a powerful reminder that in crypto, security is not only about technology—but also about user awareness. As attackers continue to refine social engineering tactics, even small lapses in attention can lead to catastrophic losses.
Always:
Verify wallet addresses character by character
Avoid copying addresses from transaction history
Revoke unnecessary token approvals
Stay cautious when signing permissions
📌 This article is for informational purposes only and does not constitute investment advice. Always conduct your own research before making financial decisions.
👉 Follow for more crypto security updates, on-chain insights, and market news. Stay safe out there.
#CryptoSecurity #Web3