The crypto world lost more than $3.4 billion this year to cunning social engineering attacks, proving hackers are now targeting humans, not code. From January to December 2025, scams exploited trust and panic rather than technical flaws, with February’s Bybit hack alone swallowing nearly half the total stolen funds.
Hackers gained entry through deceptive conversations, then injected malicious scripts to reroute transactions. “Attackers aren’t breaking in—they’re being invited in,” said Nick Percoco, Chief Security Officer at Kraken, highlighting that the weakest link remains human behavior.
Experts warn 2026 may be even trickier. Supply chain vulnerabilities, cloud credential leaks, and automated AI scams are making attacks faster and more convincing. Lisa, security lead at SlowMist, noted, “Developers must verify packages, isolate builds, and review updates before deployment to stay ahead.”
AI-driven phishing, deepfake Zoom calls, and fake hiring tests have already fooled crypto founders. Steven Walbroehl, CTO at Halborn, recommends cryptographic proof-of-personhood, biometric authentication, and anomaly detection to counter these high-tech schemes.
Physical “wrench attacks,” where criminals target crypto holders in person, also rose in 2025, with 65 recorded incidents. Security advisors stress keeping crypto holdings private, cleaning personal data online, and beefing up home security.
Traditional security steps remain vital. Experts urge using hardware wallets, unique passwords, and multi-factor authentication. “No legitimate service will ever ask for your seed phrase or login credentials,” Percoco emphasized. Regular audits, segregated systems, and radical skepticism are now the frontline defenses against the growing social engineering threat.
Crypto security is shifting from firewalls to mental fortitude. Automation, verification, and cautious digital habits are key to keeping funds safe in a world where AI scams and human deception dominate.
