North Korean hacking groups have been targeting the crypto sector for quite some time now. The $625 million Ronin bridge exploit in 2022 served as an early warning sign, but the threat has continued to evolve over the years.

In 2025, North Korean-affiliated attackers have been involved in various campaigns aimed at draining value and compromising key players in Web3. They have targeted assets worth $1.5 billion at Bybit through credential-harvesting efforts, with millions already laundered. Additionally, they have launched malware attacks on MetaMask and Trust Wallet users, tried to infiltrate exchanges using fake job applicants, and established shell companies in the U.S. to target crypto developers.

While the media often focuses on major theft incidents, the truth is that the weakest link in Web3 is not smart contracts, but human error.

Nation-state attackers no longer need to exploit vulnerabilities in Solidity. They now target the operational weaknesses of decentralized teams, such as poor key management, lack of onboarding processes, unverified contributors pushing code from personal devices, and treasury governance conducted through platforms like Discord. Despite the industry’s emphasis on resilience and censorship resistance, many protocols remain vulnerable to sophisticated adversaries.

At Oak Security, where we have conducted over 600 audits across various ecosystems, we consistently observe this gap in security. Teams invest heavily in smart contract audits but overlook fundamental operational security practices. This oversight often leads to compromised contributor accounts, governance capture, and preventable losses.

Despite significant resources directed towards smart contract security in the DeFi space, many projects still neglect basic operational security protocols. The assumption that passing a code audit guarantees protocol safety is not just naive but also perilous.

The focus has shifted from smart contract exploits to targeting individuals operating the system. Many DeFi teams lack dedicated security leads and manage large treasuries without formal accountability for operational security. This lack of oversight is concerning.

OPSEC failures extend beyond attacks from state-sponsored groups. In May 2025, Coinbase revealed that an overseas support agent, bribed by cybercriminals, unlawfully accessed customer data, leading to a costly remediation process. Binance and Kraken also faced similar social engineering attacks. These incidents were not caused by coding errors but by insider corruption and human error.

The vulnerabilities are systemic across the industry, with contributors onboarded through unsecure platforms like Discord or Telegram, code changes made from unvetted devices, and sensitive discussions held in unencrypted tools. Without proper security measures in place, teams are ill-equipped to handle security breaches effectively.

What the DeFi sector can learn from traditional financial institutions is the importance of a strong security culture. Banks and payment companies operate under the assumption of inevitable attacks and have layered defenses to mitigate risks. DeFi teams need to adopt a similar mindset and invest in structured security programs and tools for key management.

Decentralization should not be an excuse for negligence in operational security. Web3 platforms must prioritize cybersecurity practices to prevent malicious actors from exploiting vulnerabilities. Culture and disciplined security practices will play a crucial role in safeguarding the future of decentralized finance.