“$152 Million Ethereum Lost to Phishing in 2024”

In 2024, the Web3 community faced an explosion of phishing attacks, resulting in a total of approximately $494 million in losses. This figure represents a 67% increase from the previous year, according to the 2024 Scam Sniffer phishing report. While the number of victims only increased by 3.7%, the losses per attack skyrocketed, with the largest individual loss reaching $55.48 million.

Overview of the Attacks

Ethereum was the most affected, with 25 notable incidents accounting for $152 million in losses. Other blockchain networks such as Arbitrum, Blast, Base, and BNB Chain were also attacked, but none of them suffered as heavily as Ethereum.

Timeline of the Attacks

• First quarter: The largest loss occurred with $187.2 million and 175,000 victims. March was the darkest month with $75.2 million in stolen funds, mainly due to high activity on the blockchain due to the increased Bitcoin price.
• Second and third quarter: Phishing attacks peaked, with August and September seeing losses of $55.48 million and $32.51 million respectively. These months were responsible for more than half of the year’s total major losses.
• Fourth quarter: A drop to $51 million in losses, thanks to improved security measures and a higher awareness campaign among users and projects.

Evolving Attackers’ Tactics

In 2024, the strategies of wallet drainers changed significantly, with the downfall of major malware such as Pink in the second quarter, after which Inferno was able to claim a 45% market share by the end of the year. Attackers also learned new methods to bypass security measures, including:

• Wallet normalization: Abusing wallet normalization processes.
• Signature abuse: Using phishing signatures such as ‘Permit’ and ‘setOwner’ for concentrated thefts, with the largest incident resulting in a loss of $55 million in DAI.

Bright Spots Amid the Chaos

Despite the challenges of 2024, the year also offers opportunities for improved security measures and technologies. There is growing hope that the future holds safer days for the Web3 community. This requires a joint effort from developers, security analysts, and users to improve the security of decentralized finance (DeFi).