SlowMist: Phishing attacks remain the primary reason for Q4 fund thefts, with 300 stolen cases recovered and $1 million USD recovered.

Mars Finance reports that SlowMist released an analysis of stolen funds in Q4 2025. In the fourth quarter of 2025, there were 300 reports of fund theft (excluding cases reported through other channels), with approximately 1 million USD successfully frozen or recovered in 9 cases. The three main causes of theft incidents are: phishing attacks, scams, and private key leaks. Phishing remains the primary cause of losses, ranging from fake domains to auto-complete hijacking redirects. Phishing is no longer limited to “clicking on the wrong link.” One victim mistakenly sent 50 million USDT to a forged address that closely resembled the original—only the first 3 characters and the last 4 characters were identical.