The Bybit attack crystallized a threat that the crypto industry has been reluctant to fully reckon with: the most dangerous attack surface in the space is not the code. It's the people who interact with it. Social engineering fueled more than 60% of all crypto security incidents in 2025. And increasingly, attackers aren't stopping at digital manipulation.
When the Threat Gets Physical
Parallel to the surge in digital social engineering, a more visceral threat category has been escalating: physical attacks on crypto holders and operators. Known as "wrench attacks" in security circles — a reference to the idea that physical coercion can defeat any digital security — these incidents jumped 75% in 2025, with at least 65 recorded cases according to Jameson Lopp's physical attack tracker. The previous record, set during the 2021 bull market peak, was 36. Chainalysis notes a clear correlation between wrench attack frequency and Bitcoin price movements, noting that personal wallet compromises now represent 23.35% of all crypto theft activity in 2025 — suggesting opportunistic targeting intensifies during high-value periods, with 2025 on track to have potentially twice as many physical attacks as any prior year on record.
The targets are no longer exclusively retail holders who publicly broadcast their crypto wealth. Threat actors are increasingly mapping the organizational charts of exchanges, custodians, and DeFi protocol teams — identifying keyholders, signers, and infrastructure administrators. A compromised human with signing authority is often more valuable than any contract exploit.
Sophisticated threat actors — including DPRK-linked groups — don't scan codebases for vulnerabilities. They research LinkedIn, GitHub profiles, and conference speaker lists to identify who holds signing keys and administrative access. Once a high-value target is identified, the attack can take weeks or months to execute. By the time it materializes, the entry point looks completely legitimate from every monitoring system in place.
"Attackers aren't breaking in — they're being invited in. The majority of hacks don't start with malicious code; they begin with a conversation."
— Nick Percoco, CSO, KrakenThe Attack Vectors Driving the Losses
Phishing and impersonation are the dominant entry points, but the vector landscape has diversified significantly. North Korean actors have industrialized the fake job offer vector — posing as recruiters or developers to infiltrate exchanges and DeFi protocol teams, plant insider access, and execute long-horizon attacks that can take months to materialize. Two DPRK clusters drive this activity: TraderTraitor (Jade Sleet / Slow Pisces), responsible for the Bybit supply chain attack, and Contagious Interview (Famous Chollima), which approaches targets via LinkedIn with scripted pitches requesting "collaborators" on projects. The Bybit attack methodology followed patterns consistent with these documented DPRK operations, according to Chainalysis. North Korea's total crypto theft in 2025 reached $2.02 billion — a 51% year-over-year increase, with the Bybit hack accounting for 74% of that total and 44% of all crypto theft globally that year. DPRK's cumulative crypto theft since tracking began is estimated at $6.75 billion.
Impersonation attacks — where threat actors pose as exchange support staff, investment partners, or project managers — accounted for at least $9 million in losses in the three months following January 2026 alone, according to AMLBot. SIM swapping continues to circumvent SMS-based two-factor authentication at scale, while insider threats and bribery are growing concerns at institutions managing significant on-chain assets.
The common thread across every vector: they all bypass technical controls entirely by exploiting human trust. A SIM swap doesn't attack an authentication system — it circumvents it. A fake job offer doesn't break into a codebase — it installs a trusted insider. A wrench attack doesn't need a private key — it just needs the person who holds it to cooperate.
What Robust Defense Actually Looks Like
The defensive response has to be layered across both the human and technical dimensions — and critically, it must include enforcement mechanisms that remain effective even when a human has been compromised.
On May 4, 2026, Binance launched Withdraw Protection — a feature allowing users to lock all on-chain withdrawals from their accounts, specifically designed to neutralize the wrench attack scenario. Even under physical coercion, a locked account cannot be drained in real time. It's a product-level acknowledgment that no amount of digital security solves a threat that bypasses digital controls entirely.
The technical control layer must include pre-signature behavioral simulation — evaluating what a transaction will actually do before any human signs it. When a compromised signer is manipulated into authorizing an anomalous transfer, behavioral baselines fire regardless of whether the credential is legitimate. Unusual destination addresses, transaction amounts outside historical norms, or approval scopes that deviate from expected patterns all generate risk signals before the blockchain confirms anything. This is the same pre-execution enforcement layer that defends against smart contract exploits — and it's equally effective against a socially engineered signer. Platforms deploying this capability intercept the attack at the transaction layer, not the identity layer — the only place where a compromised human's authorization can still be stopped.
| Defense Measure | Threat Addressed | Applies To | Effectiveness |
|---|---|---|---|
| Hardware MFA / Passkeys | SIM swaps, phishing credential theft | Exchanges, Custodians, DeFi | ✓ High — eliminates SMS 2FA risk |
| Out-of-Band Tx Verification | Social engineering of signers; insider threats | Custodians, Exchanges | ✓ High — confirms intent independently |
| Timelocked Withdrawals | Coerced transfers; wrench attacks | All operators | ✓ High — Binance Withdraw Protection model |
| Multi-sig + MPC Key Management | Single-point key compromise; bribery | DeFi protocols, Custodians | ✓ High — threshold prevents unilateral action |
| Pre-Sig Behavioral Simulation | Anomalous tx patterns post-compromise | All operators | ✓ High — catches credential-enabled exploits |
| Address Allowlisting | Unauthorized destination addresses | Exchanges, Custodians | ✓ High — limits exfiltration paths |
| Employee Security Training | Phishing, fake job offers, impersonation | All operators | ⚠ Partial — humans remain exploitable |
| Incident Response Playbooks | Reduces damage window post-breach | All operators | ⚠ Partial — reactive, not preventive |
Multi-sig and MPC wallets distribute signing authority so no single compromised individual can authorize a transfer. Out-of-band transaction verification confirms signer intent through a channel separate from the primary interface — the exact control that would have flagged the modified transaction UI in the Bybit attack. Hardware-based MFA and passkeys eliminate the SIM swap attack surface by removing phone-based authentication entirely. And pre-signature behavioral simulation provides a final enforcement layer that fires even when the credential is legitimate but the intent is malicious. Together, these controls create a defense that requires an attacker to simultaneously compromise multiple independent systems — the only meaningful deterrent against sophisticated, patient threat actors.
Crypto security that only hardens the code while leaving the humans around it unprotected is incomplete. The Bybit attack didn't need a zero-day. It just needed one developer to trust the wrong person.
— CoinHub Today Research Desk, May 2026The Bottom Line
Over $3.4 billion in 2025. Sixty-five physical attacks. A $1.5 billion exchange hack executed not through a code exploit but through a manipulated developer. The lesson is unambiguous: crypto security that only hardens the code while leaving the humans around it unprotected is incomplete.
The institutions that will weather the next wave are those that treat key management, signing workflows, and behavioral anomaly detection as a unified system — one that remains resilient even when a human in the chain has been compromised. The attacker's path of least resistance is always the person, not the protocol. Building defenses that account for that reality is no longer optional.