Phishing scams persisted as a major vulnerability, responsible for $8.5M in February theft
February witnessed a dramatic downturn in cryptocurrency theft, with blockchain security experts reporting the lowest monthly losses in nearly a year. Leading security platforms PeckShield and CertiK documented total losses between $26.5 million and $35.7 million throughout the month.
This represents a significant improvement from January’s $86 million figure, marking a decline exceeding 69% in just one month. The contrast becomes even starker when compared to February 2025, when the massive $1.5 billion Bybit exchange compromise dominated the statistics.
While February recorded 15 separate security incidents, two major attacks drove the majority of financial damage. The most significant breach targeted YieldBlox, a decentralized autonomous organization operating a lending protocol on the Stellar blockchain, resulting in $10 million in stolen assets.
On February 22, an exploiter took advantage of low liquidity conditions within the USTRY/USDC trading pair. Through a strategically executed abnormal transaction, the attacker artificially pumped the token’s valuation by 100x, manipulating the system into permitting massive undercollateralized loan withdrawals.
The month’s second-largest security failure struck IoTeX, a blockchain platform focused on Internet-of-Things applications, on February 21. Unauthorized access to a compromised private key granted the attacker entry to the project’s token safe.
The perpetrator rapidly converted stolen tokens into ETH before moving funds through multiple cross-chain bridges toward Bitcoin. While CertiK’s analysis estimated damages near $9 million, IoTeX representatives contested this figure, claiming actual losses were closer to $2 million.
Foom.Cash, a privacy-focused protocol, suffered the third-largest attack with $2.2 million in losses. The exploit leveraged a cryptographic vulnerability to manufacture fraudulent zkSNARK proofs, generating fake authentication credentials that bypassed protocol security measures.
According to PeckShield’s analysis, February’s reduced numbers stem largely from the absence of any catastrophic “mega-hack” comparable to previous incidents like the Bybit breach. Additionally, a significant Bitcoin price downturn early in the month, with values falling beneath $70,000, redirected market focus away from protocol vulnerabilities.
Kronos Research’s Dominick John attributed the improvement to enhanced risk management protocols, elevated counterparty vetting standards, and superior real-time security monitoring deployed across major cryptocurrency platforms. He highlighted that artificial intelligence-powered code auditing tools and automated vulnerability detection systems are identifying weaknesses before exploitation occurs.
Despite encouraging overall trends, phishing schemes continue plaguing the crypto ecosystem. These social engineering attacks claimed $8.5 million during February.
The proliferation of “drainer-as-a-service” operations, including platforms like Angel Drainer and Inferno Drainer, has democratized sophisticated phishing campaigns. These services supply turnkey solutions including replica websites, counterfeit social media profiles, and pre-built malicious smart contracts, requiring only a revenue-sharing agreement with operators.
PeckShield recommended that both institutional players and high-value individual wallet holders implement multi-signature cold storage solutions while maintaining rigorous private key security protocols.
Notably, wallet drainer-related losses have shown substantial year-over-year improvement, declining from $494 million throughout 2024 to $83.85 million across 2025.
