How do crypto thieves steal coins, and are the thefts getting bigger by 2026?

"Specifically, users are tempted to visit phishing websites and sign phishing transactions that allow scammers to withdraw their tokens."

"Specifically, tempted by high profits, users are tricked into visiting fake websites and signing transactions that enable scammers to steal their crypto assets."

"In this model, drainer operators focus on crafting specialized phishing toolkits, named ''wallet drainers'', while drainer affiliates handle the deployment and promotion of phishing websites."

"The past year has witnessed 11 large-scale TxPhish incidents causing a total loss of more than 70 million."

"After stealing victims' tokens, they will distribute profits."

"the FreezeAccount instruction to freeze the token account"

"Since fraudsters usually hold a significant proportion of the"

"Rug-pull, a typical form of fraud, involves developers hiding backdoor codes in smart contracts to steal funds under certain conditions, causing significant damage to users."

"Wallet-drainer phishing losses rose to $494 million across more than 332,000 affected wallets in 2024, then fell to approximately $83.85 million across 106,106 affected wallets in 2025."

"A wallet drainer is a phishing tool that tricks a user into authorizing a malicious transaction or signature."

"estimated wallet drainers stole close to $494 million in 2024 alone from more than 332,000 addresses, and more than $800 million since 2023"

"Drainer-as-a-Service lowered the technical barrier for affiliates by providing prebuilt scripts, phishing templates, hosting, dashboards, and operational support."

"Pink Drainer retired in May 2024 after being linked to more than $85 million in theft from over 21,000 victims."

"On Solana, the equivalents are the mint and freeze authorities, whose mere existence hands the deployer a kill switch."

"A wallet drainer is the turnkey toolkit that turns a wallet -connect handshake into an immediate sweep of the victim's tokens"

"a single Permit2 signature on a malicious front end can authorise an unbounded allowance the drainer sweeps later"

"Furthermore, some smart contracts can be controlled by "admin keys" or "super users" with special privileges. These users can make changes to protocol parameters or, in certain cases, access assets held within a protocol."

"These users may have the ability to unilaterally make changes to the smart contract, enable or disable features on the smart contract, change how the smart contract receives external inputs and data or transmits Digital Assets, and make other changes to the smart contract."

"Theyfoundthattheliquiditywithdrawalscollectivelyhave generated$240millioninprofits."

"If an attacker gains access to these privileges or a super user acts maliciously, customers may experience a total loss of their assets' value."

"There may be opportunities for bad actors to perpetrate fraudulent schemes and engage in illicit activities and other misconduct, such as exit scams and rug pulls (orchestrated by developers and/or influencers who promote a smart contract or application and, ultimately, escape with the money at an agreed time), or Ponzi or similar fraud schemes."

"Lastly,Everemovesalltheliquidityfromtheliquidity"

"todraintokenvaluefromtheliquiditypool"

"such governance tokens can be concentrated in the hands of a small group of core community members, who would be able to make similar changes unilaterally to the smart contract."

"Other smart contracts, such as bridges between blockchain networks and DeFi protocols have also been manipulated, exploited or used in ways that were not intended or envisioned by their creators such that attackers syphoned over $3.8 billion worth of digital assets from smart contracts in 2022."

"enabledeveloperstoretainlarge"

"in July 2017, a vulnerability in a smart contract for a multi-signature wallet software developed by Parity led to a reportedly $30 million theft of ether, and in November 2017, a new vulnerability in Parity’s wallet software reportedly led to roughly $160 million worth of ether being indefinitely frozen in an account."

"in March 2020, a design flaw in the MakerDAO smart contract caused forced liquidations of crypto assets at significantly discounted prices, resulting in millions of dollars of losses to users who had deposited crypto assets into the smart contract."