Cryptocurrency Hack Losses Fall 87% in February as Scammers Shift to Phishing

​

The total value stolen in major cryptocurrency hacks and scams fell sharply to approximately $49.3 million in February, a significant drop from $385 million in January, according to new data from Nominis. However, security experts warn this reprieve masks a more insidious trend, with attackers pivoting from technical exploits to targeting human psychology.

The February 2026 report indicates a clear shift in criminal tactics, moving away from smart contract flaws toward phishing, malicious approvals, and address poisoning. Most losses stemmed from "authorization abuse," where victims unknowingly signed fraudulent transactions or granted wallet access. Private users bore the brunt of these attacks, while large platforms avoided major breaches.

A notable exception was a $30 million infrastructure breach at Solana analytics platform Step Finance, which accounted for over 60% of February's total losses. The steep monthly decline has fostered cautious optimism, with security firm PeckShield reporting a similar low of $26.5 million, attributing it to improved controls and monitoring across exchanges and DeFi projects.

Yet the calm may be fragile. "Social engineering attacks caused more cumulative damage than smart contract exploits," Nominis stated, highlighting a sustained shift toward exploiting human trust. While platforms are strengthening defenses—Bybit reported blocking over $300 million in unauthorized withdrawals in late 2025—losses remain staggering, with Chainalysis estimating $3.4 billion stolen last year.

The data underscores that technological security alone is insufficient. The primary risks now reside at the intersection of technology and human behavior, involving user permissions, transaction signatures, and everyday wallet habits.