Web3 Security - Hacks, Scams, and Exploits

The talk opens with the scale of crypto theft, citing about $3.4 billion stolen in 2025 with North Korea attributed to a large share, and frames Web3 as three layers that can each fail: the user's client, the web frontend that builds transactions, and the on-chain code. The client section covers weak wallet randomness that exposed hardware wallet keys, private keys leaked in published scripts, seed-phrase phishing, clipboard hijacking, address poisoning, and approval drainers. Blind signing, where users approve transaction data they cannot read, is presented as the common thread. The frontend section covers fake airdrop lures, hijacked DNS and cloud storage, and compromised developer machines and libraries. A co-presenter explains MEV, including sandwich attacks and why private mempools help.

The smart contract section covers reentrancy, price oracle manipulation amplified by flash loans, governance attacks, access control mistakes, cross-chain replay, and bridge failures. The speakers stress that upgradeable proxies let defenders patch code but also let attackers who hold upgrade keys strip protections.

The closing case study is the Bybit theft. An attacker compromised a developer at the multisig provider Safe, injected JavaScript that targeted one exchange's signers, and swapped a routine cold-to-hot transfer for a transaction that upgraded the wallet and removed its signature requirements. Takeaways include clear signing on hardware wallets, subresource integrity for scripts, independent transaction simulation, avoiding upgrade paths that allow delegate calls, and treating privileged staff access as an attack surface.