Crypto security experts say that the majority of cryptocurrency exploits will not be due to a bug zero-day in your favourite protocol. You’re going to cause it.
Nick Percoco told Cointelegraph, “2025 showed that most hacks begin not with malicious code, but with conversation.”
“Attackers aren’t breaking in, they’re being invited in.”
Data from Chainalysis indicates that between January 2025 and early December 2025 the crypto-industry experienced theft of over $3.4 billion. February compromise Nearly half the total is Bybit.
The bad actors used social engineering to gain access and then injected malicious JavaScript code that enabled them modify the transaction details.
What is Social Engineering?
The Social Media engineering is a cyberattack Method that induces someone to reveal confidential information, or perform actions that compromise the security.
Percoco stated that battleground for crypto security The mind is the place to be, and not cyberspace.
“Security is no longer about building higher walls, it’s about training your mind to recognize manipulation. The goal should be simple: don’t hand over the keys to the castle just because someone sounds like they belong inside or are instilling panic.”
Tip #1: Automate as much as possible
Percoco says that supply chain compromises are also a major challenge for this year. A seemingly insignificant breach could prove disastrous later, since “it’s a digital Jenga tower, and the integrity of every single block matters.”
Percoco advises that, in order to reduce the human trust point for digital interactions and transactions over the next year, it is important to automate defenses wherever possible. “shift from reactive defense to proactive prevention.”
“The future of crypto security will be shaped by smarter identity verification and AI-driven threat detection. We’re entering an era where systems can recognize abnormal behavior before the user, or even trained security analysts, can even realize something is wrong.”
“In crypto especially, the weakest link remains human trust, amplified by greed and FOMO. That’s the crack that attackers exploit every time. But no technology replaces good habits,” he said.
Tips 2: Silo infrastructure
Lisa, SlowMist’s security operations manager, says that in 2018, bad actors targeted more developer ecosystems. In addition, cloud-credentials leaks created the opportunity to insert malicious code, steal secret information, and poison updates.
“Developers can mitigate these risks by pinning dependency versions, verifying package integrity, isolating build environments, and reviewing updates before deployment,” “She said”
Lisa believes that the biggest threats in 2026 will be sophisticated social engineering and credential theft.
“Threat actors are already leveraging AI-generated deepfakes, tailored phishing, and even fake developer hiring tests to obtain wallet keys, cloud credentials, and signing tokens. These attacks are becoming more automated and convincing, and we expect this trend to continue,” “She said”
Lisa recommends that organizations implement access control measures, such as key rotation and hardware-backed authentication. She also suggests infrastructure segmentation along with anomaly detection, monitoring, and strong security.
People should not rely on hardware walletsTo avoid being scammed, be sure to cross-check the identities of all parties involved. Also, treat links and downloads that you have not requested with caution.
Tips 3: Use proof of human personhood in order to combat AI Deep Fakes
Steven Walbroehl predicts AI enhanced social engineering to play an important role in crypto hackers’ playbooks.
Three of the four major statewide elections will be held in March. crypto founders reported foiling an attempt The alleged North Korean hackers stole sensitive data by using fake Zoom calls which used deepfakes.
Walbroehl warns hackers use AI to create context-aware, highly personalized attacks.
In order to counter this problem, the author suggests using cryptographic verification of identity for critical communications. Other solutions include hardware-based biometrics, anomaly detection, which baselines transaction patterns normal, and verification protocols that use pre-shared phrases or secrets.
Tips 4: Don’t share your Crypto with others
According to Jameson Lopps, Bitcoin OG, and cypherpunk, there were at least 65 instances of wrench attacks in 2025. Last but not least, the last decade has seen a rise in physical attacks on crypto holders. According to Jameson Lopps’ GitHub list of Bitcoin OG and cypherpunk Jameson Lopps. bull market peak in 2021 It was the worst ever year with 36 attacks recorded.
Former CIA officer Beau is a X user. said On Dec. 2, an X posted that wrench attacks are still relatively rareBut he recommends cryptocurrency users to take precautions and avoid using the crypto currency. talking about wealth or disclosing crypto holdings Start by looking at extravagant lifestyles on the internet.
Also, he suggests that you become a “hard target” By using data cleaning tools to conceal private information such as addresses and home security devices like alarms and cameras.
Do not skimp out on tried and tested security tips
David Schwed is a security specialist who worked as Chief Information Security Officer at Robinhood. His top tip: stick with reputable companies that have vigilant security practices. This includes rigorous third-party audits on their entire stack from smart contracts and infrastructure to regular, rigorous security assessments.
Schwed advised that, regardless of which technology is used, it’s best to avoid using the exact same password on multiple accounts. He also recommended the use a hardware device as part of a multifactor method.
He recommends utilizing a dedicated hardware wallet when holding significant amounts and minimising holdings at exchanges.
Related: Spear phishing is North Korean hackers’ top tactic: How to stay safe
“Security hinges on the interaction layer. Users must remain hyper vigilant when connecting a hardware wallet to a new web application and must thoroughly validate the transaction data displayed on the hardware device’s screen before signing. This prevents ‘blind signing’ of malicious contracts,” Schwed added.
Lisa’s best advice is to use only official software and avoid visiting unverified URLs. She also recommends separating funds between hot, warm and cold configurations.
Counter the increasing sophistication of scams like social engineering Percoco, Kraken’s Percoco, recommends phishing “radical skepticism” Verify the message’s authenticity at all times and consider it a test for awareness.
“And one universal truth remains: no legitimate company, service, or opportunity will ever ask for your seed phrase or login credentials. The moment they do, you’re talking to a scammer,” Percoco was added.
Walbroehl suggests a number of measures, including the use of cryptographically-secure random numbers generators to generate keys, separating development environments from production ones, conducting regular security audits, and planning incident response with regular drills.
Magazine: When privacy and AML laws conflict: Crypto projects’ impossible choice
“This article is not financial advice.”
“Always do your own research before making any type of investment.”
“ItsDailyCrypto is not responsible for any activities you perform outside ItsDailyCrypto.”
Source: cointelegraph.com
