Web3 infrastructure risk: what practitioners need to act on

TL;DR: Infrastructure and operational compromises, rather than smart contract bugs, accounted for 74% of stolen crypto value in H1 2026, according to FYEO's analysis of Blockaid reporting. That shift means protocol security now depends on signers, deployments, third-party dependencies, and monitoring, not audits alone.

Editorial analysis by NHI Mgmt Group, based on content published by FYEO: “Web3 Security Shifts: Infrastructure Failures &…”.

By the numbers:

• 74% of stolen crypto value in H1 2026 resulted from infrastructure and operational compromises, according to FYEO.
• The number of incidents recorded in H1 2026 was approximately 3.4 times the total for all of 2025, according to FYEO.

Key questions

Q: What breaks when a web3 protocol does not govern signer access properly?

A: The protocol can still be drained or altered even when the smart contract code is sound, because attackers abuse the signing path rather than the logic.

Q: Why do compromised signers create more risk than isolated contract bugs?

A: A contract bug usually affects a specific code path, but a compromised signer can authorise many actions across the protocol.

Q: How can security teams tell whether dependency risk is being managed well in web3?

A: Look for a complete inventory of external services, explicit trust boundaries, and monitoring for changes in those dependencies.

Practitioner guidance

• Implement signer lifecycle governance Inventory every signing key, multisig role, and delegated approval path, then assign owners, review cadence, and revocation rules.
• Map protocol dependencies and trust boundaries Document every bridge, oracle, node provider, identity service, and shared component that can affect transaction integrity or availability.
• Replace audit-only assurance with continuous monitoring Track changes in exposure, signer behaviour, dependency drift, and anomalous onchain activity after deployment.

Bottom line: Web3 loss events are increasingly driven by operational control failures rather than direct contract exploitation.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →