Top 10 Crypto Asset Security Threats: The Attacks Behind Most Losses and Their Fixes

Most crypto asset losses do not come from broken cryptography: they come from stolen signing access, people tricked into approving the wrong transaction, and suppliers whose code sits between staff and the wallet. This list ranks the ten threats that cause the largest and most frequent losses for exchanges, custodians, DeFi teams and the people who hold assets with them, with what each looks like, how to detect it and what to fix first. The ranking is an editorial judgement drawn from FBI and IC3 public service announcements, Chainalysis loss data for 2025 and incident pages in the NHI Mgmt Group breach database. It is written for security leads at crypto businesses, fraud teams and executives who need a short, defensible priority list. For what to do once funds are moving, read the Web3 Incident Response Playbook; this page is about stopping the incident before it starts.

Key takeaways

• Signing infrastructure is the prize. Chainalysis reports that attacks on private key infrastructure and signing processes caused 88% of losses in the first quarter of 2025, and more than 3.4 billion US dollars was stolen across the year.
• State actors work through people first. The FBI describes North Korean operators researching staff on job platforms, building rapport for weeks and delivering malware through fake job tests.
• The supplier's front end is part of your wallet. The 1.5 billion US dollar Bybit theft went through modified JavaScript in a third-party signing interface, not through Bybit's own servers.
• Fraud against customers is the biggest volume problem. The FBI's 2024 Internet Crime Report puts cryptocurrency investment fraud as the costliest category, at more than 6.5 billion US dollars in reported losses.
• Most fixes are identity fixes. Short-lived and device-bound sessions, just-in-time privilege, independent transaction verification and narrow support-tool access close more of this list than any single crypto-specific product.

The Top 10 at a glance

1. Compromise of private keys and signing infrastructure

Whoever can produce a valid signature owns the asset, and there is no chargeback. Chainalysis's December 2025 review of the year attributes 88% of first-quarter 2025 losses to attacks on private key infrastructure and signing processes at centralised services, and records North Korean actors stealing at least 2.02 billion US dollars in 2025. Hot wallets with keys on internet-connected servers remain the simplest target; the BitMart hot wallet hack shows how one stolen key drained two hot wallets of about 150 million US dollars.

• Detect: withdrawals outside policy windows, new destination addresses on treasury wallets, key access from hosts that do not normally sign, and any change to signer sets or thresholds.
• Fix: keep hot wallet balances to an operational float, hold keys in HSMs or MPC schemes with no single holder, require approvals from separate people on separate devices and networks, and rotate signer devices on a schedule. See the MPC Wallet Security Guide and the Crypto Exchange Identity and Key Security Guide.

2. Targeted social engineering of staff and developers

The FBI's September 2024 public service announcement (I-090324-PSA) warns that North Korean actors pick DeFi and crypto firms, research employees on professional networking and job sites, and build tailored scenarios, usually a job offer or an investment, then sustain conversations for long periods before delivering malware. They impersonate recruiters and known contacts, use stolen profile photos and fake company websites, and know the industry well. The same actors are tracked by the FBI as TraderTraitor. See the North Korea Cyber Operations Guide and the Lazarus Group Threat Actor Profile.

• Detect: developers running unfamiliar repositories or containers, new browser extensions or launch agents on macOS, and outbound connections from engineering laptops to newly registered domains.
• Fix: the FBI recommends verifying contacts through a separate channel, never running pre-employment tests or recruiter code on company devices, keeping seed phrases and keys off internet-connected devices, and requiring approvals from several unconnected networks before moving company funds. Hiring pipelines also need checks for fraudulent remote workers: see the Insider Threat from Fake IT Workers Guide.

3. Supply chain compromise of wallet interfaces and libraries

Signers trust what their screen shows. In the Bybit hack, malicious JavaScript served from the Safe{Wallet} front end changed a routine cold-wallet transfer for Bybit's contract address only, and was removed about two minutes after the theft. The FBI attributed the roughly 1.5 billion US dollar theft to North Korea in its 26 February 2025 announcement (I-022625-PSA). Package registries are the same exposure for any team that ships wallet connectors or SDKs (ATT&CK T1195.002 Compromise Software Supply Chain).

• Detect: unexpected changes to hashes of front-end bundles you depend on, new versions of wallet libraries outside a planned update, and any script loaded from a host not on the allow-list.
• Fix: self-host or pin signing interfaces, use subresource integrity, require two-person review for releases of anything that touches signing, and inventory every third-party component in the path from operator to key. See the Web3 Developer Operational Security Guide.

4. Theft of cloud and developer session tokens

The Bybit chain started earlier: according to Safe's preliminary findings summarised on our breach page, a developer's macOS laptop was compromised through a malicious Docker project, and the attackers hijacked the developer's active AWS session tokens, which let them act without passing MFA. An attempt to register a new MFA device failed, but the stolen sessions were enough to change files in the S3 bucket that served the front end. This is ATT&CK T1539 Steal Web Session Cookie and T1550.001 Application Access Token: MFA at sign-in does not protect a session that is already issued.

• Detect: the same session used from a new IP or ASN, API calls that change production storage from a developer identity, and failed MFA registration attempts, which are often the only visible trace.
• Fix: shorten cloud session lifetimes, bind sessions to managed devices, remove standing write access to production front-end storage from human accounts and give it to a narrowly scoped pipeline identity, and use just-in-time elevation. See the Developer Workstation and IDE Security Guide.

5. Blind signing and transaction manipulation

A multisig with three honest signers still fails if all three approve the same manipulated payload. Hardware wallets that show only a hash, and web interfaces that render a friendly summary of opaque calldata, mean the signer is trusting software they cannot see into. Chainalysis also notes attackers tricking legitimate signers into authorising malicious transactions and abusing third-party wallet integrations. A common pattern is a transfer that becomes a contract call changing the wallet's logic or ownership, which then lets the attacker move everything.

• Detect: transactions whose decoded function is not a plain transfer, delegate calls from treasury wallets, and any payload whose hash differs between two independent tools.
• Fix: decode and simulate every high-value transaction on a separate machine with separate software before signing, compare the hash shown on the hardware device, set policy that treasury wallets cannot make delegate calls or change owners without a separate ceremony, and use devices that support clear-signing. See the Crypto Wallet Security Guide.

6. Insider and outsourced support abuse

Customer data is a step towards customer funds. In the Coinbase insider breach, criminals paid overseas support agents to copy customer records, including names, contact details, government ID images, balances and transaction history, for 69,461 people. The data was then used to impersonate Coinbase and persuade customers to send funds, and Coinbase estimated remediation and reimbursement costs at 180 million to 400 million US dollars. No private keys or passwords were taken, yet the loss was large.

• Detect: record views that do not match an open ticket, agents viewing far more accounts than peers, bulk screenshots or exports, and high-balance accounts viewed without a customer contact.
• Fix: scope support tools to the case at hand, mask sensitive fields by default, treat outsourced staff as third-party risk with the same access reviews and log sharing as employees, and give exposed customers withdrawal allow-listing and extra verification.

7. Cryptocurrency investment fraud

By reported loss, this is the largest threat on the list. The FBI's 2024 Internet Crime Report states that investment fraud involving cryptocurrency was the costliest category, at more than 6.5 billion US dollars, within total reported losses above 16 billion US dollars. Victims are groomed over weeks, often through messaging apps or dating sites, shown fake gains on fraudulent platforms and then asked for fees to withdraw. The victim usually authorises every transfer, so controls that look for unauthorised access do not fire.

• Detect: first-time buyers sending most of a large deposit to a single external address within hours, repeated transfers to addresses that fraud intelligence links to known scam platforms, and customers who say a "broker" or "mentor" is guiding them.
• Fix: add cooling-off periods and in-flow warnings for first large withdrawals to new addresses, train support staff to recognise coaching, and share indicators with law enforcement and industry. See the Investment Fraud Prevention for Banks and Platforms Guide and the Cryptocurrency Scam Awareness Guide.

8. Phishing, wallet drainers and malicious approvals

On EVM chains, a token approval gives another address the right to move a token balance later, and many interfaces ask for unlimited allowances by default. Drainer kits combine phishing sites, fake airdrops and impersonated support accounts with requests for approvals or off-chain signatures that look harmless. Chainalysis counted 158,000 personal wallet compromises affecting at least 80,000 victims in 2025, with 713 million US dollars stolen from individuals. See the Crypto Scam and Drainer Guide.

• Detect: for platforms, customer reports of approvals to unknown spenders and domains that imitate your brand; for individuals, unknown allowances in a token approval checker.
• Fix: approve exact amounts, review and revoke allowances regularly, keep long-term holdings in a hardware wallet that is never connected to experimental dApps, and publish a clear statement that staff will never ask for a seed phrase.

9. SIM swap and exchange account takeover

The IC3 public service announcement of February 2022 recorded 1,611 SIM swap complaints and more than 68 million US dollars in adjusted losses in 2021, up from 320 complaints over the three previous years. Criminals move the number by impersonating the victim to the carrier, bribing a carrier employee or phishing carrier staff, then use SMS codes and password reset to take over linked accounts (ATT&CK Mobile T1451 SIM Card Swap). The FBI specifically advises people not to advertise crypto holdings online.

• Detect: a password reset followed by a new device and a withdrawal address change within a short window, and sign-ins from a new carrier or region after SMS recovery.
• Fix: remove SMS as a recovery and second factor for exchange accounts, offer passkeys or security keys, enforce a hold period after any security setting change, and support withdrawal address allow-lists. See the SIM Swap Fraud Guide and the Crypto Exchange Account Security Guide.

10. Smart contract and DeFi protocol flaws

Code that holds funds is attacked in public, with no need for credentials. The OWASP Smart Contract Top 10 covers the recurring classes, including access control weaknesses, price oracle manipulation, logic errors, reentrancy, unchecked external calls and flash loan attacks. Many large protocol losses combine a flaw with an operational weakness such as an upgrade key held by one person. See the OWASP Smart Contract Top 10 Guide and the Smart Contract Access Control Guide.

• Detect: on-chain monitoring for large single-block price moves on oracles you depend on, unexpected calls to admin and upgrade functions, and abnormal outflows from pools.
• Fix: independent audits before each release, timelocks and multisig on upgrades, rate limits and pause functions held by a separate guardian, and a funded bug bounty. See the Smart Contract Upgradeability Guide.

Detection: what to monitor across the list

Useful measures: percentage of treasury value held outside hot wallets; median time from an unusual withdrawal alert to a hold decision; percentage of human accounts with standing write access to production signing paths (target zero); percentage of customer accounts on phishing-resistant MFA; time to revoke a departed contractor's access; and the share of high-value transactions independently decoded before signing.

Common failure patterns

• Trusting the multisig count: three signers using the same interface on the same type of laptop is one control, not three, as the Bybit theft showed.
• MFA treated as the finish line: stolen sessions and tokens bypass sign-in MFA entirely, so session lifetime and device binding matter as much.
• Developers with production publish rights: everyday engineering accounts that can change what signers load turn one phished developer into a treasury incident.
• Support tools that show everything: broad read access for outsourced agents made the Coinbase data theft possible without any technical intrusion.
• Fraud controls that only look for intruders: investment fraud is authorised by the victim, so controls must look at behaviour, not just authentication.
• No plan for the first hour: the FBI notes stolen funds are rapidly converted and spread across thousands of addresses, so contacts with exchanges, analytics firms and law enforcement must exist before the incident.

Lessons from incidents

The breach database shows the same shape repeatedly. The Bybit hack combined threats 2, 3, 4 and 5: social engineering of a supplier's developer, stolen cloud sessions, modified front-end code and signers who could not see the real payload. The Coinbase insider breach shows threat 6 feeding threat 7, with stolen records used for impersonation. The BitMart hot wallet hack is the plain case of threat 1. For a cross-incident analysis, see Crypto exchange breaches.

Mapping to ATT&CK and NIST

For crypto-specific control sets, the CryptoCurrency Security Standard Guide covers key generation, storage and usage, and the MiCA and DORA for Crypto-Asset Service Providers Guide covers EU obligations.

Where to start

1. Week 1: list every person, device, supplier and piece of software that sits between an operator and a signing key, and remove standing human write access to anything in that path.
2. Week 2: introduce independent transaction decoding for every treasury movement above a threshold and test it with a dry run, including the rollback of a held transfer.
3. Month 1: shorten cloud and identity provider session lifetimes for engineers and signers, move them to managed devices and phishing-resistant MFA, and pilot with one team before rolling out.
4. Month 2: scope support tool access to open tickets and turn on access anomaly alerts.
5. Month 3: run a tabletop of a front-end compromise and a social engineering lure against a developer, using the Web3 Incident Response Playbook, and pre-agree contacts with exchanges and analytics firms.

Practitioner checklist

• Hot wallet balances capped at an operational float with automated sweep to cold storage.
• Treasury approvals require separate people on separate devices and networks.
• Every high-value transaction decoded and simulated outside the signing interface.
• Third-party signing interfaces pinned or self-hosted, with integrity checks.
• No human account holds standing write access to production front-end storage.
• Recruiter tests and unknown code never run on company devices.
• Support agents see only ticket-linked records, with sensitive fields masked.
• SMS removed as a factor and recovery method for staff and offered alternatives for customers.
• On-chain monitoring for signer, owner and upgrade changes, with an on-call owner.
• Law enforcement and industry contacts documented before any incident.

Standards and references

• FBI IC3: North Korea Responsible for 1.5 Billion Dollar Bybit Hack (I-022625-PSA)
• FBI IC3: North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks (I-090324-PSA)
• FBI IC3: Criminals Increasing SIM Swap Schemes to Steal Millions of Dollars from US Public
• FBI: FBI Releases Annual Internet Crime Report (2024)
• Chainalysis: North Korea Drives Record 2 Billion Dollar Crypto Theft Year
• OWASP: Smart Contract Top 10
• MITRE ATT&CK: T1195.002 Compromise Software Supply Chain
• MITRE ATT&CK: T1539 Steal Web Session Cookie

Related NHI Mgmt Group resources: Web3 and Crypto Security Guide, Web3 Incident Response Playbook, Crypto Crime Statistics Guide, DeFi Risk Guide.