CertiK expert: Hackers are winning the arms race for now

​The crypto industry continues to lose billions of dollars to hacker attacks. However, some of the biggest threats stem not from vulnerabilities in blockchain technology itself, but from weaknesses in the systems and people surrounding it. In an interview with Traders Union, CertiK Senior Blockchain Investigator Natalie Newson explained why hackers are staying ahead of security professionals, how secure crypto wallets really are and what users can do to protect their funds.

Hackers are changing their tactics

In the first half of 2026, the crypto industry lost approximately $1.31 billion across 344 security incidents, according to CertiK's Hack3D report. At first glance, the situation appears to have improved compared with last year, but Natalie Newson believes these figures paint a misleading picture.

The apparent improvement largely reflects the $1.45 billion Bybit hack in the first half of 2025. Excluding that single incident, industry losses actually increased by approximately 28% year over year.

“So the underlying environment hasn’t improved, and in some respects it has gotten worse. Most of that damage didn’t come from brilliant code-breaking, but rather from compromised wallets and from people being socially engineered.”

Code vulnerabilities remain the leading cause of attacks by incident count. In the first six months of 2026, CertiK recorded 204 such incidents, resulting in approximately $152 million in losses. However, wallet compromises proved the most destructive, with just 33 incidents causing more than $444 million in losses.

Phishing attacks accounted for another $366 million in losses. While the number of phishing incidents fell by more than half compared with the previous year, financial losses declined by only 11%.

“Attackers are moving away from mass campaigns toward a handful of highly targeted social engineering attacks, and just four incidents accounted for around 85% of all phishing losses.”

The biggest vulnerability lies outside the blockchain

Hackers tend to target ecosystems where large amounts of capital are concentrated. In the first half of 2026, Ethereum recorded the highest number of incidents, with 153 attacks resulting in approximately $523 million in losses. Solana experienced significantly fewer attacks, but losses still reached $315 million.

A substantial share of the damage came from just two hacks. In April, attackers stole $291 million from Kelp DAO and $285 million from Drift Protocol. Together, these incidents accounted for nearly 44% of the crypto industry's total losses during the six-month period.

“The biggest weakness isn’t really the blockchain itself. It’s the off-chain layer everything depends on: key management, signing workflows, front ends, and infrastructure such as RPC providers.”

These off-chain weaknesses help explain why even projects that have undergone independent security audits can still fall victim to hackers.

“An audit is a snapshot of specific code at a specific moment, not a permanent seal of approval.”

Newson also points to a growing tendency among attackers to target older smart contracts that have been operating for more than a year. Their vulnerabilities may have gone unnoticed during earlier reviews. That is why CertiK recommends complementing audits with continuous monitoring, bug bounty programs and additional security reviews after code changes.

AI gives hackers a temporary advantage

Artificial intelligence is changing the battle between cybercriminals and companies protecting the crypto industry. Hackers can now create convincing deepfakes, generate phishing messages in multiple languages and automate fraudulent operations.

AI also helps attackers identify code vulnerabilities more quickly, reducing the technical expertise required to launch sophisticated attacks. Cybersecurity companies, meanwhile, are using the same technology to scan code at scale, detect suspicious transactions and trace complex cryptocurrency laundering schemes.

“Both sides are benefiting, and right now it’s a real arms race.”

Yet the two sides operate under very different constraints. Unlike criminals, cybersecurity companies must comply with regulatory requirements and ensure their tools deliver reliable results.

“In the short term, I think attackers get the edge, because they adopt new tools without any compliance or accuracy constraints.”

The balance could shift in the longer term. Newson believes security professionals could eventually gain an advantage thanks to their access to large amounts of data and the ability to scale their defenses. However, this will require the crypto industry to invest more actively in these technologies.

Hackers are moving from digital attacks to physical violence

Criminals are increasingly targeting cryptocurrency holders directly, using physical violence and intimidation to gain access to their assets. Such attacks can involve kidnappings, home invasions and extortion. Victims include crypto project founders, company executives, wealthy investors and even their family members.

Known as wrench attacks, these crimes involve physical coercion intended to force victims to surrender their cryptocurrency. Their rise is driven by instant and irreversible cryptocurrency transfers, personal data leaks and investors' own public activity.

“There’s also an irony here: as digital security improves, the human becomes the easiest way in.”

Newson advises people with substantial cryptocurrency holdings to avoid publicly disclosing information about their assets and to use security mechanisms that prevent any single person from transferring all the funds independently.

These include multisignature wallets and time-locked transactions. Such measures can make theft more difficult even under physical coercion, as criminals cannot simply gain access to one wallet or force its owner to transfer funds immediately.

Can cold wallets still be trusted?

Physical threats also raise questions about how cryptocurrency should be stored. Even devices that remain disconnected from the internet depend on the reliability of their firmware, supply chains and the actions of their owners.

However, Newson does not believe these risks make hardware wallets obsolete.

“Cold storage is still the strongest option most people have.”

The expert recommends purchasing devices directly from manufacturers, verifying and updating firmware regularly, and keeping seed phrases secure.

For substantial holdings, she also advises using multisignature arrangements so that asset security does not depend on a single device or manufacturer. Keeping private keys offline still provides substantial protection against online attacks.

Can Web3 ever become secure?

Of the $1.31 billion lost in the first half of 2026, only about $115 million was frozen or recovered, according to CertiK. The remaining funds had not been frozen or recovered during the reporting period.

The average loss per incident was approximately $3.8 million, but the median was significantly lower, at around $139,000. This indicates a large number of smaller attacks affecting lesser-known projects and their users.

Newson believes the crypto industry can significantly improve security, but doing so will require a different approach to product development.

“Nobody thinks about encryption when they use online banking, and that’s the standard Web3 has to reach.”

In her view, crypto wallets should clearly explain what users are signing and warn them before they interact with potentially malicious services. Better tools for recovering access and funds after security incidents are equally important.

Users should not need an in-depth understanding of blockchain technology to manage their assets safely.

“Risk will never be zero, as it isn’t in traditional finance, but the direction is right.”

Ultimately, the future development of Web3 will depend not only on improvements to blockchains and smart contracts, but also on how effectively the industry can protect ordinary users from mistakes, fraud and emerging forms of attack.