How Web3 Users Actually Get Hacked (It's Not the Code)

I audit smart contracts for a living, and here is the uncomfortable truth about how people actually lose their crypto: almost never through a bug in the contract. They lose it because someone convinced them to sign a transaction, run a repo, paste a command, or type twelve words into the wrong box. The code held. The human got played.

That gap has a name — the human layer — and it is the one layer no audit covers. Attackers worked this out a long time ago. Breaking cryptography is expensive; convincing a tired person to click "Approve" is cheap. So the money followed the cheap path. Approval and signature phishing alone has drained users of over $2.7 billion since 2021 (Chainalysis), and none of it required a single line of vulnerable Solidity.

TL;DR

• The largest crypto thefts run through people, not contracts. The $625M Ronin hack started with a fake job offer, not a reentrancy bug.
• Almost every attack shares one skeleton: a lure, manufactured pressure, and a single pivot — the moment "just looking" becomes signing, running, pasting, or sending.
• The specific attacks change monthly, but the shapes don't: wallet-drainer approvals, gasless signature phishing, fake jobs, ClickFix, address poisoning, seed-phrase phishing, and long-con investment traps.
• Being targeted isn't personal — it's about access. A user has funds, a developer has keys and repos, a founder has a treasury. Attackers cast a wide net for all three.
• The habit that defends against nearly all of it: when something is urgent and profitable and wants you to sign/run/paste, slow down and do the opposite of what the message wants.

Why can't a smart-contract audit protect me?

Because an audit checks whether code does what it should — not whether you will paste a command a fake CAPTCHA told you to. In a bank, a human can often reverse a fraudulent charge. In DeFi you are the bank: self-custody means no institution sits between a mistake and a total, permanent loss. That permanence is exactly what attackers rely on. They don't need to be clever. They need you to act once, fast, before you stop and think.

So the goal isn't to memorize a hundred scams. It's to learn the skeleton underneath them, then recognize each shape when it wears a new costume. (If you're newer to this, start with the plain-English tour of the five most common crypto scams, then come back here for the developer-and-founder-grade version. And for the other side of the coin — how the protocols themselves get exploited — see why crypto protocols get hacked.)

What does every one of these attacks have in common?

Two halves and one hinge. The social half earns your trust: a lure (a job, an airdrop, a support message), something that makes it feel legitimate (a polished profile, a verified account, a countdown), and pressure (urgency, authority, fear, greed). The operational half delivers the damage: a repo, a signature request, a pasted command, a link.

Between them sits the pivot — the one action that actually hurts you: sign, run, paste, approve, send, or enter your seed. Everything before the pivot is reversible; you can close the tab. Everything after usually isn't. Learn to feel the pivot coming and you can spot attacks you have never seen before.

The attacks, by the pivot they steer you toward

Here's the field, each linked to a deep dive and to a drill where you can face it in a safe replica of the real app.

They want you to sign an approval or a permit. This is the drain that never asks for your password. You connect your wallet to a fake claim page and sign what looks like a login — but it's a token approval or a gasless permit handing a stranger's contract permission to move your funds. BadgerDAO lost ~$121M this way in 2021 (Microsoft). Read approval phishing explained and permit & Permit2 signature phishing, then run the approval-phishing drill.

They want you to run their code. A "recruiter" sends a take-home repo; npm install fires a postinstall script that steals your keys before you read a line. The fake-job crypto scam (a.k.a. "Contagious Interview") is how a single poisoned PDF led to the $625M Ronin bridge theft. Face it in the fake-recruiter drill.

They want you to paste a command. ClickFix shows a fake "verify you're human" widget, silently copies a command to your clipboard, and tells you to open your terminal and paste it. No real CAPTCHA ever does that. Try the ClickFix drill.

They want you to send to the wrong address. Address poisoning plants a lookalike address into your transaction history so you copy the wrong one — a whale nearly lost $68M to it in 2024. And packaged wallet drainers (rented as a service for a 20–30% cut) automate the whole sweep; drainers stole ~$494M in 2024 (Scam Sniffer).

They want your seed phrase. Seed-phrase phishing uses fake breach emails, fake wallet apps, even physical letters with a QR code. The rule is absolute: a real hardware wallet never asks for your 12 or 24 words on a screen, site, email, or call.

They want you to invest. Pig butchering is the long con — a warm relationship, a fake platform showing fake gains, then a "tax" you must pay before you can withdraw. The FBI logged ~$5.8B in crypto investment fraud in 2024 (FBI IC3).

What's the one habit that stops most of this?

Ask a single question at the pivot: "Am I about to sign, run, paste, send, or enter my seed — because someone else created this moment?" If yes, stop. Then apply the structural defenses that don't depend on you being sharp that day:

• Run untrusted code only in a throwaway VM with no wallets or keys. "Just run it" means "just get owned."
• You initiate transactions, from a site you navigated to yourself via a bookmark — never because a DM, ad, or call told you to.
• A signature is never "free." Read the method and spender before you sign. Audit and revoke old approvals with revoke.cash.
• Your seed phrase goes nowhere. No exceptions.
• No web page ever tells you to run a command. That gesture is the kill switch.
• Compartmentalize: a hardware "vault" wallet for holdings, a burner for mints; a clean machine for keys, a dirty one for anything strangers send.

None of this requires you to out-think a professional social engineer in the moment. It requires structure, built once, so a bad moment costs you far less than it should.

Where to actually practice this

Reading about an attack and recognizing it live are different skills, and only the second one saves you. That's why we built Defense: a range where you're dropped into faithful replicas of the exact surfaces these attacks arrive on — a LinkedIn DM, a Telegram chat, a wallet popup, a fake airdrop — and you make the call in a simulator where nothing is real and nothing sends. Do the mistake there, so you never make it here.

Related questions

Why don't smart-contract audits stop these attacks? An audit verifies that code behaves correctly; it can't stop a human from signing a malicious approval, running a stranger's repo, or entering a seed phrase into a fake site. Those attacks target the person operating the wallet — the human layer — which no audit covers.

What is the single most common way people lose crypto? Approval and signature phishing: connecting a wallet to a fake page and signing what looks like a harmless "login" but is actually a token approval or gasless permit that lets an attacker move your funds later. It has drained over $2.7 billion since 2021.

Do I have to be a specific target, or is it random? Both. Attackers run high-volume campaigns and cast a wide net, but they target by access: users for their funds, developers for their keys and repositories, founders for their treasuries. If you hold crypto or write code in this space, you're in scope — but it's your access they want, not you personally.

Is a hardware wallet enough to keep me safe? It's essential but not sufficient. A hardware wallet keeps your keys offline and lets you verify a transaction on its own screen, which defeats clipboard swaps and fake modals. But it can't stop you from approving a malicious transaction yourself — you still have to read what you're signing and refuse gasless permits you didn't intend.

What's the fastest way to build the reflex? Practice recognizing the attacks on the surfaces they actually use. Run the free drills in Defense: each drops you inside a replica of a real attack, lets you decide, and shows you the red flags — so the pattern is muscle memory before you meet the real thing.