INDUSTRY FACT FILE · BLOCKCHAIN, WEB3 & VIRTUAL DIGITAL ASSETS

Threat Landscape: Top Cyber Threats Facing Blockchain and VDA Businesses

The 18 most relevant cyber threats, attacks and industry challenges for VDA exchanges, brokers, custodians, wallet providers, Web3 and DeFi projects, NFT and gaming platforms and enterprise blockchain platforms, and the impact each has.

Digital asset businesses face an unusual mix of attackers. State-linked groups, which Chainalysis estimates took at least US$2.02 billion in 2025, run long social engineering campaigns against exchange staff, signers and developers and patiently compromise the tools they use. Organised fraud groups take over customer accounts, steal API keys, open mule accounts with synthetic or borrowed identities and move proceeds through mixers and cross-chain bridges. Smart contract attackers read public code, find logic errors or manipulable price feeds and exploit them in a single transaction, often followed by copycats. Phishing crews build lookalike sites, fake apps and drainer contracts aimed at retail users and NFT communities. Insiders with access to keys, hot wallets or customer data can do as much damage as outsiders, and ransomware, DDoS and cloud misconfiguration affect these platforms as they do any online business, but at moments when markets are moving and users cannot wait.

Public reporting shows how these threats play out. The FBI attributed the theft of about US$1.5 billion from Bybit in February 2025 to North Korea's TraderTraitor activity; investigators found malicious code injected into a third-party multisig interface had shown signers a false transaction. WazirX lost more than US$230 million in July 2024 when the transaction its signers approved did not match what they saw, CoinDCX lost about US$44 million from an internal operational account in July 2025, and the Ronin bridge lost assets then worth more than US$600 million in March 2022 after attackers took five of its nine validator keys. Code flaws cost the Wormhole bridge about US$320 million in February 2022 and the Nomad bridge about US$190 million in August 2022. In India, FIU-IND's 2026 Guidelines respond directly to fraud and laundering risks, with liveness checks, travel rule data and controls on mixers and unhosted wallets.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by blockchain, Web3 and VDA segment (Codec Networks assessment).

4.1 Keys, signers and the screens they trust

The largest thefts of 2024 and 2025 did not break cryptography; they persuaded authorised signers to approve the wrong transaction. In the Bybit case, investigators found that code injected into a third-party multisig interface showed signers a routine transfer while the payload replaced the wallet's logic, and WazirX said the transaction its signers approved differed from what the custody interface displayed. Hot wallet servers, MPC nodes and operational wallets held outside core policies are the other common route to a drain.

• Questions to test: Do signers decode every transaction independently of the interface that proposed it? Do hardware signers show full call data? Are allow-lists, limits and time-locks enforced by policy? Is every wallet we control inventoried and monitored, including operational ones?
• Relevant services: custody architecture and signing policy review, signer interface and tooling assurance, red teaming of withdrawal paths, managed SOC with on-chain monitoring and hack response.

4.2 Smart contract and upgrade exploits

Smart contracts hold user funds in public code that anyone can call. A missing validation, a faulty initialisation or a manipulable price oracle can be exploited in one transaction, and once an exploit is visible on-chain, others can copy it, as the Nomad bridge showed in August 2022. Upgradeable contracts add a second risk: whoever controls the upgrade or admin keys controls the protocol, so those keys and processes need the same protection as a treasury.

• Questions to test: Has every contract and every upgrade been independently audited? Are invariants tested with fuzzing in CI? Are upgrades timelocked and monitored? Who holds admin and pause keys, and how are they protected? Is there a rehearsed playbook for pausing and communicating?
• Relevant services: smart contract audits for Ethereum, Solana and Polygon, fuzzing and invariant testing, oracle and economic risk review, admin-key and upgrade process review and live contract monitoring.

4.3 Bridges, validators and nodes

Cross-chain bridges hold large pools of locked assets and rely on validators, relayers or light clients to confirm what happened on another chain. Taking over enough validator keys, as attackers did with five of Ronin's nine in 2022, or exploiting a signature-verification flaw, as at Wormhole the same year, lets an attacker mint or release assets that were never deposited. Exchanges and DeFi teams also depend on their own nodes and third-party RPC providers for accurate chain data.

• Questions to test: How many keys must be compromised to move bridged funds, and who holds them? Are validator and node hosts hardened, segmented and monitored? Do we cross-check chain data from more than one source? Would we notice an abnormal withdrawal within minutes?
• Relevant services: bridge and validator security review, node and infrastructure VAPT, cloud and key management review, monitoring of bridge contracts and withdrawals, and incident response.

4.4 People, developers and the supply chain

State-linked groups invest months in social engineering: fake recruiters, malicious coding tests, poisoned packages and compromised third-party tools. A single developer laptop or build pipeline can expose cloud keys, hot wallet secrets or the code that signers rely on, which is how investigators described the route to the Bybit theft. Wallet libraries, custody software, KYC vendors and analytics providers all extend the attack surface into suppliers.

• Questions to test: Are developer devices managed and monitored? Are secrets kept out of code and pipelines? Do we verify the integrity of front-end code and libraries before signers use them? Have critical vendors been assessed, and are their access paths limited?
• Relevant services: secure SDLC and pipeline review, secrets and cloud configuration review, third-party and wallet tooling assessments, phishing and social engineering simulations, and SOC monitoring of developer and admin activity.

4.5 Fraud, laundering and AML technology

Exchanges are both targets and channels. Fraudsters open mule accounts with synthetic or borrowed identities, take over genuine accounts and use transfers to mixers, unhosted wallets and other chains to obscure proceeds. FIU-IND's 2026 Guidelines respond with liveness-checked selfies, geo-location and device capture, penny-drop checks, real-time travel rule messaging, unhosted wallet monitoring, non-facilitation of mixers and tamper-proof audit trails. Each of those controls is a system that can be bypassed, misconfigured or breached.

• Questions to test: Can our KYC flow detect injected video, emulators and reused devices? Does travel rule data travel in real time and securely? Are mixer and high-risk address screens applied before withdrawals? Are audit trails tamper-proof and complete enough to reconstruct any transaction?
• Relevant services: KYC and onboarding application testing, AML control and record reviews, on-chain screening and monitoring review, log architecture review, fraud investigations and blockchain forensics.

• CERT-In: incidents reported within six hours of noticing them; logs and KYC and transaction records available for investigation; CERT-In may issue directions and advisories.
• FIU-IND: registration, renewal and the cyber security audit it calls for can be affected by security and AML failures; penalties under Section 13 of the PMLA have been imposed on platforms.
• Law enforcement: thefts and frauds lead to police complaints, freezing requests to other platforms and requests for records and evidence.
• Banking and payment partners: incidents and AML concerns can lead partners to suspend rupee deposits and withdrawals.
• DPDP Act: breach intimation and safeguards for personal data of users once provisions commence; SEBI LODR disclosure for listed group companies.
• Overseas regulators: platforms serving users abroad may face notification duties under regimes such as the EU's MiCA.

• If our signing interface were altered tomorrow, would any signer notice before approving?
• Is every wallet we control, including operational and partner-venue accounts, inventoried and monitored?
• Has every smart contract and upgrade been independently audited, and who holds the admin keys?
• How do we protect developers and pipelines from the social engineering state-linked groups use?
• Would our KYC, travel rule and mixer controls stand up to FIU-IND's 2026 Guidelines and an independent audit?
• Could we detect, contain, trace and report a theft within six hours, including at night?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from official statements and widely reported events; attributions are those of the authorities or researchers named, and disputed points are noted. Nothing here is investment advice.