Crypto Hacks Fall to $49M in February as Attackers Shift to Phishing Scams

Why It Matters

The shift toward social‑engineering attacks highlights that human error, not just code flaws, is the weakest link, urging firms to bolster user‑centric security measures. Continued decline in large‑scale exploits could boost confidence in crypto adoption if safeguards keep pace.

Key Takeaways

• February crypto losses fell to $49M.
• Step Finance breach caused $30M loss.
• Phishing and wallet authorization abuse now dominate attacks.
• Private users most targeted, not exchanges.
• Industry security improves, but human error remains vulnerability.

Pulse Analysis

The February dip in crypto‑related hacks signals a notable change in threat vectors. While smart‑contract vulnerabilities have historically driven headline‑grabbing breaches, recent data from Nominis shows phishing and malicious wallet approvals now account for the bulk of financial damage. This pivot reflects attackers’ recognition that exploiting user behavior can be more reliable than finding code flaws, especially as platforms harden their protocol layers.

The Step Finance incident underscores the potency of authorization abuse. By masquerading as legitimate requests, attackers coaxed users into granting sweeping wallet permissions, enabling the swift exfiltration of $30 million. Private individuals, lacking the institutional safeguards of exchanges or DeFi protocols, bore the brunt of these scams. Such attacks exploit the trustless nature of blockchain interfaces, where a single approved transaction can move funds without further verification, emphasizing the need for robust UI warnings and multi‑factor confirmations.

Industry players are responding with enhanced fraud‑prevention tools. Bybit’s system, which blocked over $300 million in unauthorized withdrawals last quarter, illustrates how real‑time monitoring and address blacklisting can mitigate losses. Yet, as Chainalysis notes, cumulative yearly hacks still exceed $3 billion, indicating that technology alone cannot eradicate risk. A balanced approach—combining advanced analytics, stricter onboarding controls, and comprehensive user education—will be essential for sustaining growth and restoring confidence in the crypto ecosystem.