In April, crypto phishing incidents hit a record low, amounting to just $38 million in theft, as reported by security firm Scam Sniffer. This decrease aligns with CertiK's findings, which noted a historic drop to $25.7 million in crypto-related scams and exploits during the same period.

Scam Sniffer's report highlighted a notable surge in phishing attacks on Base, an Ethereum layer-2 network backed by Coinbase. Incidents on this platform skyrocketed by 145% to reach $8.2 million in losses, with two of the largest single thefts occurring within this chain, constituting 21% of the total theft for the month.

ERC-20 tokens bore the brunt of these attacks, accounting for 88% of the stolen assets. The primary tool utilized by scammers was the creation of fake accounts on the social media platform X (formerly Twitter). These accounts impersonated well-known projects like Renzo, Avail, Ether.fi, Wormhole, and Omni, often featuring fake verification marks to appear authentic and lure unsuspecting users.

These fraudulent accounts posted deceptive comments on social media platforms, directing individuals to malicious websites where their assets could be stolen. Additionally, attackers commonly employed phishing signatures such as Permit, IncreaseAllowance, and Uniswap Permit2, which allowed them to gain unauthorized access to victims' funds. Despite efforts by wallets to increase phishing alerts for these signatures, attackers found ways to circumvent these measures using legitimate contracts like Disperse and Uniswap Multicall, as well as variants of value normalization.