Summary:
- Around $370.3 million in crypto was stolen in January, according to CertiK.
- Losses were nearly four times higher than the same month a year earlier.
- Phishing made up the bulk of the damage, with over $311 million linked to these scams.
- One victim alone reportedly lost about $284 million in a social engineering attack.
- Security firms say the data shows attackers are still leaning heavily on social engineering.
January turned into one of the worst months for crypto security in almost a year. The total value lost to hacks, exploits and scams reached roughly $370.3 million, marking the highest monthly figure in 11 months and a steep jump compared with last January. The scale of the number stands out, but the way the money was lost tells the bigger story. Crypto security firm CertiK summed it up bluntly on X:
That last line focuses away from complex smart contract bugs and toward something far more human. Social engineering scams trick users into handing over access, signing malicious transactions, or revealing sensitive information. In this case, a single victim reportedly lost around $284 million, which made up a large share of the month's total losses. The broader numbers underline how sharp the rise has been. The latest figure represents a more than 277% increase from January a year earlier, when losses were about $98 million. It is also a 214% jump from December, which saw $117.8 million in crypto stolen, according to CertiK's shared data.
Source: CertiK
Even in a market used to big numbers, this kind of month-to-month swing is hard to ignore. It shows that while tools and audits improve, attackers keep finding ways to scale damage quickly, especially when they can focus on individuals rather than hardened protocols.
Phishing Dominates While Protocol Hacks Still Add Pressure
A large amount from $370 million stolen came from phishing, which accounted for $311.3 million over the month. That means the majority of the losses were not from breaking code directly, but from manipulating people into making the wrong move at the wrong time. At the same time, direct protocol hacks have not gone away. Another security firm tracking the space, PeckShield, pointed out that January still saw multiple notable technical exploits. The firm said the crypto sector experienced 16 hacks during the month, totaling $86.01 million in losses. While that figure showed a slight year-over-year decrease compared with January the previous year, it marked a clear rise from December. PeckShield also highlighted that phishing losses alone exceeded $300 million during the same period.
Among the larger protocol-level incidents, PeckShield noted the $13.3 million hack on liquidity provider SwapNet on Jan. 26 and the $7 million exploit against the blockchain protocol Saga on Jan. 21. These numbers are smaller compared with the giant phishing case, but they still show that weaknesses in smart contracts and system design continue to create openings. CertiK's historical comparison adds more things. January's losses are the largest monthly total since February of the previous year, when attackers stole around $1.5 billion in a single month, much of it tied to a major exchange breach. That earlier spike came from one huge event. January's figure, by contrast, mixes one massive social engineering case with a long list of smaller incidents.
This matters because It suggests that the threat landscape is not just about rare, extreme hacks. It is also about constant background risk from everyday scams, phishing links, fake support messages and impersonation tactics. Those methods do not require advanced code skills, only a convincing story and a moment of user distraction.
What These Losses Mean for Users and the Industry
When one phishing incident can wipe out hundreds of millions of dollars, it forces a hard look at where crypto security still falls short. Wallets, exchanges and protocols can add layers of technical protection, but if users are tricked into signing malicious transactions or sharing access, those defenses often cannot help. The numbers from January show that education and user-side tools are as important as audits and bug bounties. Clear transaction warnings, address screening, phishing detection and simpler interfaces can reduce risk, but they need to keep pace with attackers who constantly adjust their tactics.
For builders, the lesson is that security does not end at the smart contract. Social engineering now operates at the same scale as technical exploits. For users, the message is less comfortable but simple. Large sums are being lost not only because code fails, but because trust is being abused. It is also a reminder that crypto's biggest weak point is often the human layer sitting above the blockchain. Until that gap narrows, months like this may keep returning, even as the underlying tech gets stronger.