Human-Targeted Attacks Are Now Web3’s Most Dangerous Threat, Report Finds

A latest report by Kerberus, a Web3 safety agency, means that human conduct is now the first danger in Web3.

BeInCrypto spoke with the agency’s CEO, Alex Katz, and CTO, Danor Cohen, to grasp why customers proceed to fall sufferer to assaults and what they’ll do to higher shield themselves.

Human Error Drives Major Web3 Losses, Kerberus Report Finds 

In its newest report titled “The Human Factor – Real-Time Protection Is the Unsung Layer of Web3 Cybersecurity (2025),” Kerberus revealed that human-focused assaults have been probably the most structurally harmful vector in Web3.

The report cites knowledge displaying {that a} important share of trade losses stems from person errors. Roughly 44% of crypto thefts in 2024 resulted from the mismanagement of personal keys. Another analysis signifies that human error is concerned in roughly 60% of safety breaches.

With 820 million energetic wallets in 2025, the risk panorama is increasing shortly, and everybody remains at risk. Katz instructed BeInCrypto that dangerous actors are concentrating on each newcomers and skilled customers, however for very completely different causes.

“New customers are engaging as a result of they don’t but perceive what ‘regular’ Web3 conduct seems to be like,” he mentioned

Interestingly, the chief famous that long-time customers have gotten more and more higher-value targets in comparison with newcomers. According to him, 

“Veteran customers work together with way more dApps, signal extra transactions, and transfer bigger quantities. That means a single second of complacency can do way more injury. So the group most in danger immediately is anybody who assumes they’re not in danger.” 

Cohen added that one of many greatest misconceptions in Web3 is the idea that safety failures stem from customers not understanding the expertise. His evaluation factors in the other way. People are getting hacked as a result of the system locations an unrealistic burden on them.

“Users assume, ‘I’m too sensible to get drained, I understand how wallets work – I’m secure.’ But the risk panorama modifications quicker than customers do. Attackers aren’t making an attempt to outsmart your pockets; they’re making an attempt to outsmart you. And they’re extraordinarily good at it.  What individuals misunderstand is that Web3 places an unlimited cognitive burden on the person. Users shouldn’t need to decipher technical indicators to remain secure – safety should work for them mechanically,” he talked about.

Why Even Smart Web3 Users Keep Getting Drained in 2025

These human-driven danger persists regardless of document spending on safety in 2025. Kerberus’ report acknowledged that crypto-related services and investors misplaced over $3.1 billion to hacks and scams in the first half of the year. This is already greater than the overall for all of 2024. 

That quantity contains the historic Bybit breach. Excluding this, human-targeted assaults comparable to phishing and social engineering nonetheless accounted for $600 million. This represented 37% of the remaining $1.64 billion in losses.

The report famous that these assaults scale with rising adoption and bypass technical defenses completely. This makes it tough for conventional safety fashions to forestall them.

While firms make investments heavily in audits, monitoring, and code reviews, attackers more and more exploit customers instantly on the transaction degree. But what makes humans so vulnerable to those assaults?

“Humans are susceptible as a result of each rip-off is designed to use pure psychological shortcuts — urgency, authority, familiarity, worry of lacking out, or consolation with routine. These will not be flaws; they’re the identical instincts that permit us to operate in on a regular basis life. Technology alone can’t change human psychology, however it could actually catch the second when psychology is being weaponized,” Cohen detailed. 

He emphasised that the strongest type of safety isn’t counting on customers to keep away from errors via schooling alone, however fairly stopping dangerous actions in real-time earlier than injury happens. 

“That’s why real-time detection issues a lot. If you’ll be able to warn a person on the actual second their belief is being manipulated, you’ll be able to cease most losses earlier than they happen,” Cohen added.

The government famous that it’s unrealistic to expect an everyday user to distinguish between a malicious dApp, an airdrop, or a mint web page. Modern fraudulent platforms usually carefully mirror legit ones. This makes them practically indistinguishable.

He added that customers can click on phishing hyperlinks repeatedly. They don’t achieve this out of carelessness, however as a result of the assaults are deliberately crafted to deceive.

Even real-time warnings can typically look like false positives, highlighting the superior nature of those scams.

“Users shouldn’t be anticipated to carry out forensic checks. The burden has to shift to instruments that analyze intent and conduct in actual time,” Cohen instructed.

The report additionally states that these assaults exploit moments when customers are least in a position to assess threats. It could occur when somebody checks their pockets whereas distracted at work, reacts to an pressing message claiming their account can be frozen, or approves a transaction on the finish of a protracted day once they’re exhausted.

According to the findings, the trade’s response has largely been so as to add extra warnings and verification steps. But this method usually backfires resulting from “safety fatigue.” As customers turn into accustomed to fixed alerts—a lot of that are false alarms that merely gradual them down—their skill to make cautious choices diminishes below the continual cognitive strain.

3 Actions Users Can Take to Stay Safer in Web3

To cut back real-world losses, Katz disclosed three practices customers can undertake. He suggested customers to:

• Pause earlier than signing: Most compromises happen in below ten seconds. Taking even a quick second to learn the immediate or verify whether or not the request aligns with the meant motion can forestall a big share of profitable assaults.
• Separate high-value property from on a regular basis exercise: Using a number of wallets stays one of the crucial efficient safeguards. He instructed that customers ought to preserve their long-term holdings in a chilly or low-touch pockets and use a separate pockets for exploration, mints, and dApps. This compartmentalization limits potential injury.
• Rely on real-time transaction safety: Because many threats contain social engineering fairly than technical exploits, customers profit from instruments that interpret on-chain actions earlier than they’re finalized. This single layer of protection blocks lots of the extra superior scams.

The intention, he careworn, is to not flip customers into safety consultants, however to construct guardrails that forestall errors from turning into monetary losses.

The submit Human-Targeted Attacks Are Now Web3’s Most Dangerous Threat, Report Finds appeared first on BeInCrypto.