Hackers Drain Nearly $370M From Crypto Users in January

Highlights:

• Hackers stole roughly $370 million in digital assets last month.
• Phishing was the most common scam technique, resulting in losses worth over $300 million. 
•  A social engineering scam accounted for the highest loss in January 2026. 

Blockchain investigation firm PeckShieldAlert reported that the crypto space recorded 16 hack incidents in January 2026, resulting in losses worth $86.01 million. According to the on-chain investigation platform, that figure represents a slight 1.42% decrease from the $87.25 million recorded in January 2025. On the other hand, it represents a significant 13.25% surge from the $75.95 million loss recorded in December 2025. PeckShieldAlert added that phishing scams were the dominant threat last month, with losses exceeding $300 million. 

Certik Alert, another leading blockchain investigation firm, published a more comprehensive report that encompassed both exploits and scams. It included a $284 million loss suffered by one victim following a social engineering scam. Unlike PeckShiledAlert, this blockchain investigation outlet reported the exact amount lost via phishing scams.

Certik Alert tweeted: 

“Combining all the incidents in January 2026, we have confirmed ~$370.3 million lost to exploits. ~$311.3 million of the total is attributed to phishing, with one victim losing ~$284 million due to a social engineering scam.”

#PeckShieldAlert In Jan. 2026, the crypto space saw 16 hacks totaling $86.01M in losses, representing a slight 1.42% YoY decrease compared to Jan. 2025 ($87.25M) but a notable 13.25% MoM surge from Dec. 2025 ($75.95M).

Meanwhile, #phishing remains staggering with losses… pic.twitter.com/pxugbsPcZ7

— PeckShieldAlert (@PeckShieldAlert) February 1, 2026

Social Engineering Tops Hack Incidents as Hackers Drain Nearly $370M

The $284 million social engineering scam accounted for over 60% of all losses last month. The attacker outsmarted the victim by impersonating a Trezor customer support agency and manipulating the victim into disclosing a recovery seed phrase, enabling the theft of 1,459 Bitcoin (BTC) and 2.05 million Litecoin (LTC) tokens. 

Another major hack last month was the $30 million exploit on the Solana-based platform Step Finance on January 31, 2026. According to reports, hackers drained several treasury and fee wallets, using a well-known attack vector, resulting in the unauthorized transfer of 261,854 SOL. The incident sparked panic selloffs among STEP token holders, as the token’s price dropped by over 90% within 24 hours. 

Other notable exploits included a $26.6 million breach at Truebit Protocol. Per reports, this security compromise was carried out through an overflow vulnerability. In addition, on-chain data showed that scammers drained 8,535 Ether from Truebit Protocol. This resulted in one of the sharpest token declines, with the TRU token price falling from $0.16 to near zero within a few hours.

Crypto2Community reported that the exploit targeted an outdated smart contract still linked to active liquidity pools. Beyond the stolen ETH tokens, a pricing error allowed attackers to mint TRU tokens at zero cost. 

Other notable security compromises include a $13.3 million exploit on Swapnet. Decentralized Finance (DeFi) protocols, including Saga and Makina Finance, lost $6.2 million and $4.2 million, respectively. Aperture Finance lost $4.2 million, while TMX lost about $1.4 million. PeckShieldAlert noted that Makina Finance has recovered $2.7 million out of the stolen funds, while many other affected platforms are still investigating the incidents.

#CertiKStatsAlert 🚨

Combining all the incidents in January we’ve confirmed ~$370.3M lost to exploits.

~$311.3M of the total is attributed to phishing with one victim losing ~$284M due to a social engineering scam.

More details below 👇 pic.twitter.com/uXhi0P6dl5

— CertiK Alert (@CertiKAlert) January 31, 2026

Hack Incidents Classification by Methods and Types

Aside from phishing, which accounted for the highest losses last month, other attack methods included code vulnerability, price manipulation, wallet compromise, and exit scam. Through these methods, hackers stole $51.5 million, $5.7 million, $1.05 million, and $471,000, respectively. Social engineering was the most common type of crypto exploit last month. Others include DeFi and address poisoning. L1 and wallet drainers were among the least common types.