The headline’s “$500 million” is a rounded estimate for cryptocurrency stolen through wallet-drainer phishing in 2024—not a count of all crypto theft. These scams trick people into signing actions that let an attacker transfer assets; connecting a wallet alone does not necessarily give a drainer that power.
What the 2024 figures measure
Scam Sniffer estimated the annual losses in its 2024 report, listed as published on January 3, 2025. SecurityWeek and BleepingComputer reported the estimate and related figures. They describe wallet-drainer activity, not exchange breaches or the full scale of cryptocurrency crime.
As an Amazon Associate I earn from qualifying purchases.
| Measure | Reported figure | Scope and source |
|---|---|---|
| Estimated losses | $494 million; a 67% year-over-year increase | Scam Sniffer’s 2024 estimate, reported by SecurityWeek and BleepingComputer in 2025. The percentage refers to dollar losses, not the number of victims. |
| Addresses affected | More than 332,000, according to SecurityWeek; more than 300,000, according to BleepingComputer | Both outlets reported Scam Sniffer’s findings. The address count should not be read as a count of unique people. |
| Largest single theft | About $55.4 million; also reported as $55.48 million | Scam Sniffer figure as reported by SecurityWeek and BleepingComputer, respectively. |
| Incidents exceeding $1 million | 30 incidents, totaling $171 million | Scam Sniffer figure reported by BleepingComputer. This amount is part of the annual loss estimate, not an additional loss. |
| One fake Android app | More than 10,000 downloads, over 150 affected addresses, and estimated losses above $70,000 | Check Point Research’s findings for one case in 2024. The app remained available for nearly five months. |
| Infected websites detected | 23,372 during 2024 | GoDaddy/Sucuri SiteCheck’s detection count, published in a 2025 report. It is not a victim count or proof that every detected site caused a loss. |
The address, app, and website figures measure different things and should not be added together. Scam Sniffer’s full report methodology is not set out in the contemporaneous coverage, so treat its annual loss figure as an estimate rather than a complete accounting of every theft.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How a wallet drainer can take assets
A drainer is better understood as a scam toolkit and the actions it induces than as one uniform program that infects every victim’s device. The delivery route and the permission requested can vary. In documented campaigns, the key danger is signing a transaction, approval, or other request that authorizes an asset transfer or gives an attacker a way to make one later.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Phishing pages and fake offers
Some campaigns advertise fake token airdrops through social media or email, sometimes using compromised verified accounts. A link leads to an imitation site that asks a visitor to connect a wallet and sign a request presented as a way to claim tokens or use a Web3 service. Scam Sniffer’s reported 2024 patterns included fake CAPTCHA or Cloudflare screens, IPFS hosting, ad traffic, and Permit or setOwner signatures. These are observed tactics, not a checklist that appears in every scam.
Malicious mobile apps
Check Point Research documented a fake Android app branded as WalletConnect. It acted as a thin client that loaded malicious functionality remotely; researchers identified MS Drainer code. In the token-theft flow they described, the victim approved a token allowance, after which the operator used TransferFrom to move tokens. The app also used fake reviews. Familiar branding, a high search ranking, or positive-looking reviews therefore do not establish that an app or its requested actions are safe.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Compromised legitimate websites
GoDaddy’s report describes drainer code injected into compromised websites, with misleading “Connect Wallet” popups prompting visitors to authorize transfers. A familiar or legitimate domain is not, by itself, proof that a wallet prompt on the page is trustworthy: a site can be compromised.
How to reduce the risk before signing
- Reach the project through a verified route. Navigate to its official site using a known bookmark or a link independently confirmed by the project. Avoid relying on an ad, unsolicited message, or social post as the only proof that an offer is genuine.
- Read the wallet request before approving it. Check what the signature or transaction does, which asset or permission it concerns, and whether the request makes sense for the action you intended. A screen that says “claim” or “connect” does not establish what the underlying request authorizes.
- Pause at warnings. Heed wallet warnings about phishing or malicious transactions where available. Do not treat a familiar site design, brand name, or app review as a substitute for understanding the request.
- Revoke an approval you believe is suspicious. Use trusted tooling for the relevant blockchain to review and revoke the permission. Confirm the chain and the specific approval before taking action; the reviewed reports do not endorse one universal revocation product.
What to do if you suspect a wallet was exposed
An approval can remain usable after the moment it was granted. Check Point Research warns that an unrevoked token allowance may let an attacker transfer tokens that arrive later. Do not keep using the affected wallet as though the danger ended with the first transfer.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
- Stop signing requests from the affected wallet and review its active permissions.
- Revoke suspicious permissions using trusted tools for the relevant chain, or move remaining assets to a newly created wallet with securely protected recovery credentials. Check Point advises stopping use of the affected wallet until permissions are revoked or assets moved.
- If you need help, contact the wallet provider or exchange through contact details you independently verify. Be wary of unsolicited “recovery” offers; do not share a seed phrase or recovery credentials with someone claiming they can retrieve stolen funds.
Why drainers are not all the same
When assessing a wallet prompt or an incident, distinguish four things: how the user was reached, what the signature or approval permits, which assets and blockchain are involved, and whether the goal is to prevent a bad authorization or contain damage afterward. A phishing page, compromised website, and malicious app are different delivery routes; a token allowance, Permit signature, ownership change, and other signed transaction are not interchangeable authorizations. That variation is why “wallet drainer” does not mean one identical piece of malware or one universal fix.
Quick Recap
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
