Phishing and social engineering scams drained an estimated $594 million from Web3 users in the first half of 2025, accounting for 36% of all losses, according to new data released by Kerberus.
Of that total, about $90 million was linked to Solana-based phishing activity, representing roughly 15% of global phishing losses during the period. The figures come from a broader dataset of $1.64 billion in Web3 hacks and scams in H1 2025, excluding the Bybit breach.
Losses on Solana alone reached $250 million during the same period, underscoring how the fast-growing blockchain has become an expanding target for attackers.
The data was released ahead of Solana Breakpoint, where Kerberus is highlighting a broader trend away from protocol-level exploits and toward user-focused deception.
User-targeted attacks rise as technical exploits decline
Security researchers say attackers are increasingly shifting from smart-contract vulnerabilities to direct wallet manipulation, exploiting approval flows and transaction permissions.
Between October 2024 and March 2025, analysts detected more than 8,000 phishing transactions on Solana, with confirmed losses of roughly $1.1 million tied to 64 phishing-linked accounts.
Researchers identified three attack vectors specific to Solana’s architecture, including account authority transfers and system account impersonation. These techniques allow attackers to take control of user wallets without traditional contract exploits.
Kerberus also points to early 2024 data showing $4.17 million stolen using just two drainer tools, illustrating how commercially available phishing kits have scaled attacks across ecosystems.
State-sponsored actors and impersonation campaigns
User-targeted tactics have also been adopted by sophisticated threat groups. In May 2025, the Lazarus Group executed a $3.2 million Solana wallet theft by tricking users into approving malicious transactions, according to blockchain investigators.
Impersonation campaigns have expanded alongside network activity. By July 2025, South Korea-based outlet CoinNess documented a wave of phishing attacks involving fake presale websites and Telegram accounts posing as the Solana Foundation.
Researchers say these campaigns exploit urgency and market hype rather than flaws in blockchain code.
Human error remains the dominant vulnerability
Kerberus’ data aligns with broader cybersecurity research showing that human error contributes to roughly 60% of digital security breaches.
Only 13% of Web3 security tools currently offer real-time transaction protection, the firm said. Most products emphasize audits, user education, or post-incident forensics rather than pre-signature intervention.
“What we see on Solana matches patterns across every fast-growing chain,” said Alex Katz, cofounder of Kerberus. “Attackers move toward moments of confusion as networks scale.”
Danor Cohen, another cofounder, said most successful scams rely on emotional triggers such as urgency, distraction, or excitement during on-chain events.
Expansion of real-time defenses to Solana
Kerberus extended its real-time browser-based transaction protection to Solana in February 2025, following its earlier deployment across Ethereum-compatible chains. The company expanded coverage further after acquiring Pocket Universe in August 2025, rolling out Solana protection to those users by November.
Kerberus says its systems are designed to block malicious transactions before approval, addressing what it views as the largest unresolved security gap in Web3.
The latest data reinforces a broader shift in crypto security. As protocol-level hacks decline, wallet-level phishing has emerged as the dominant financial threat, especially in high-growth ecosystems such as Solana.
Disclaimer: This article is for informational purposes only and does not constitute investment advice.
AI Disclaimer: Parts of this article were drafted with the assistance of AI tools and subsequently reviewed, edited, and verified by the author and our editorial team to ensure accuracy and journalistic integrity. The final version reflects human editorial judgment and fact-checking.
