Common signs include suspicious preparatory activity on-chain, patterns that match known attacker behaviour, and signals that indicate a target is being selected. The article stresses that these clues often appear before the first malicious transaction. Security teams should treat clustering of unusual actions as an early-warning problem and respond quickly, because fast containment can still reduce losses.
How preparatory Web3 attack activity usually shows up
Preparation is often visible before exploitation starts. In practice, the earliest indicators are usually not a single dramatic event, but a sequence of small behaviours that cluster around reconnaissance, target selection, and access shaping. That includes unusual contract or wallet interaction patterns, repeated probing of on-chain state, and activity that resembles a dry run rather than normal user behaviour.
For defenders, the important question is not whether one action looks suspicious in isolation, but whether the pattern is consistent with someone building an attack path. A small set of odd transactions, repeated calls against the same asset, or coordinated activity across related addresses can signal that the attacker is testing assumptions, mapping dependencies, or waiting for a profitable moment.
One useful reference point is the scale of exposure around credentials and secret material in adjacent environments: NHIMG’s Ultimate Guide to Non-Human Identities notes that 97% of NHIs carry excessive privileges, which helps explain why preparatory abuse often focuses on identifying the weakest high-value path before the first visible malicious action.
What preparatory behaviour looks like in practice
Teams should watch for behaviour that is repetitive, low-noise, and deliberately exploratory. Common examples include address clustering that suggests one operator is controlling multiple wallets, systematic scanning of contracts or bridges for assumptions, and bursts of interaction that stop short of execution or extraction. Those are often early-warning signals because they show intent without yet triggering the obvious loss event.
Preparation can also appear as environment shaping. An attacker may accumulate access, stage liquidity, probe timing conditions, or test error handling to see what the system reveals. In Web3, that matters because many attack paths depend on information asymmetry: if the adversary learns how a protocol responds under stress, the eventual exploit is usually faster and more precise.
Two internal case-study resources are especially relevant here: The 52 NHI breaches Report and 52 NHI Breaches Analysis. While they are not Web3-specific, they are useful for recognising the pattern that preparatory access often precedes abuse of high-privilege material and broadens the eventual blast radius.
Risk and Threat Considerations
Preparatory activity is risky because it is often the last point where defenders can still contain the attack before funds, keys, or control paths are abused. If the signals are ignored, the attacker may move from reconnaissance to timed execution very quickly, especially when the target has a predictable release schedule, thin monitoring, or high-value dependencies that can be triggered on demand.
Failure mechanism: The attacker uses reconnaissance, probing, and clustering to identify a weak point, then converts that knowledge into a short, high-impact transaction sequence once confidence is high.
Impact: By the time the first malicious transaction appears, the environment may already be mapped well enough for rapid draining, privilege abuse, or repeated follow-on attempts that are harder to stop.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1595 — Active Scanning | Pre-attack probing and target discovery are core to preparatory behaviour. |
| T1580 — Cloud Infrastructure Discovery | Target discovery in Web3 often resembles infrastructure discovery and mapping. | |
| Recommendation — Hunt for repeated probing and reconnaissance patterns before exploitation begins. Map discovery-like behaviour to attacker reconnaissance and escalate suspicious clustering. | ||
| CIS Controls v8 | 8.2 — Inventory and Control of Software Assets | Knowing what exists is essential to spotting suspicious target selection and unusual exposure patterns. |
| Recommendation — Maintain accurate asset visibility so preparatory targeting stands out quickly. | ||
| NIST CSF 2.0 | DE.CM — Security Continuous Monitoring | Early-warning detection depends on monitoring for unusual activity patterns over time. |
| RS.AN — Analysis | Suspicious preparatory behaviour needs rapid triage and interpretation to limit loss. | |
| Recommendation — Tune monitoring to detect clustered anomalies before the first malicious transaction. Analyze clustered anomalies quickly and decide whether containment is warranted. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage and Exposure | Preparatory attacks often look for exposed high-value secrets before abuse begins. |
| Recommendation — Search for exposed secret material that could enable rapid follow-on exploitation. | ||
Practitioner Guidance
What to prioritise: Treat unusual clustering as a triage trigger, not a curiosity. Prioritise cases where the same actor repeatedly touches high-value contracts, bridge components, or governance-related actions, because those patterns are more likely to represent attack preparation than random noise.
What to verify: Check whether the behaviour is isolated or coordinated across addresses, time windows, or protocol components. A single odd transaction may be benign; a short burst of related activity that escalates toward sensitive state changes deserves escalation.
Decision rule: If the pattern shows probing plus target selection, assume the attacker is still adapting and respond with containment steps before waiting for proof of theft. The best time to act is when the adversary is still learning, not after the exploit path has been executed.
Practitioner takeaway: In Web3, the highest-value signal is often a pattern of intent, not a completed exploit, so defenders should optimise for early containment when preparatory behaviour starts to cluster around a specific target.
Related resources from NHI Mgmt Group
- What are the signs that a cyber defense program is failing to stop common attack paths?
- What are the signs that an adversarial attack is affecting AI model outputs?
- What are the signs that credential security is not keeping pace with current attack patterns?
- What are the signs that application detection and response is failing to catch a live attack in time?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
