Blockchain Security Risks: A Layer-by-Layer Map

Video transcript

Breaking a blockchain is rare. Most losses come through keys, signers and the offchain systems around the chain.

In Guardian's analysis of DefiLlama data, keys, signers, infrastructure and people caused 82 percent of reported hack losses in 2026, through November 2.

The map has six layers: consensus, contracts, bridges, keys, infrastructure and people. Each pairs a main risk with a core control, and an attacker needs only one.

Cetus lost 223 million dollars to one missed overflow check, and Kelp DAO's single-verifier bridge lost about 290 million. About 6.36 billion left Binance wallets through an internal signing service. Drift lost about 285 million after signers pre-signed admin transactions.

To build the risk register, list every dependency and give each a named owner and a worst case in dollars. Record a control that prevents failure, one that detects it, and dated evidence it was tested.

A contract audit covers one layer: contract code at a given commit. Keys, signers, bridge configuration, nodes, cloud, domains and staff need their own controls, testing and monitoring.

Guardian's institutional practice covers these layers with advisory, smart contract audits by two competing teams, and pentests across infrastructure, apps and APIs. An OpSec audit maps every path to your funds, and who can walk it.

Read the full map for each layer's risks and controls, or talk to Guardian to map your own.

Any organization that uses a blockchain inherits risk from layers it does not run: the chain, its bridges, wallet software and vendors.

The chain itself is rarely what fails. In Guardian's analysis of DefiLlama data, keys, signers, infrastructure and people caused 72% to 74% of reported hack losses in 2024 and 2025.

In 2026 to November 2, that share was 82%. This map gives each layer its main risks, a public example and the controls that answer them.

The Map at a Glance

Six layers, one row each. An attacker needs only one.

Next, each layer in turn.

Chain and Network

Start with the chain. Whoever controls most of a chain's mining power or stake can rewrite recent blocks and reverse payments.

Small chains are the realistic target. In August 2020, Ethereum Classic suffered three such attacks in one month, CoinDesk reported.

After the second, Binance halted ETC deposits and withdrawals, The Block reported.

Two quieter risks sit in this layer too:

• Client bugs. In 2018, Bitcoin Core fixed CVE-2018-17144, which "could allow a miner to inflate the supply of Bitcoin." It knew of no exploit attempt.
• Node dependency. You see the chain through nodes and RPC providers. A poisoned node can report transactions that never happened.

Controls:

• Set confirmation depth by chain and amount, and wait for finality on large transfers.
• Read balances and events from more than one independent node or provider.
• Track client security advisories, and upgrade on a set timeline.
• Before adding a chain, check its consensus, validator count and history of reorgs and halts.

How often chains themselves are attacked is its own question: see Can Blockchain Be Hacked?

Contracts and Bridges

Smart contracts

Contracts hold the funds and enforce the rules. One logic or math error can drain them on a perfectly healthy chain.

Cetus, a decentralized exchange on Sui, lost $223M on May 22, 2025. Rekt traced it to an overflow check that missed one path in a math library.

• Write invariants for accounting and solvency, and fuzz them.
• Get an independent audit, then a review of the fixes.
• Match the deployed bytecode to the audited commit.
• Put admin functions behind a timelock, and review every upgrade.

For a protocol team's full checklist, see our guide to web3 security.

Bridges

Bridges lock assets on one chain and release or mint them on another. Whoever can forge a message, or fool the check on it, can empty them.

Kelp DAO's rsETH bridge relied on a single verifier. LayerZero says attackers poisoned two RPC nodes it used, then knocked out the rest with a DDoS attack.

The verifier confirmed transactions that never happened. About $290M was taken in April 2026.

• Require several independent verifiers, each on its own nodes.
• Cap how much can cross per hour and in total.
• Know who can change the bridge configuration, and alert on any change.
• Reconcile locked and minted supply on both chains.

Keys and Signing

Keys are the shortest path to funds. Whoever controls a signing key or signing service can move assets without any contract bug.

About $6.36B left Binance wallets on October 29, 2026, according to TRM Labs. Binance says the attacker reached an internal wallet signing service and started transactions outside the normal withdrawal process.

• Keep a small hot float, and most assets in cold, offline keys.
• Let no single person or host sign alone: use multisig, MPC or an HSM quorum.
• Enforce limits and allowlisted destinations inside the signing system.
• Decode and simulate every admin transaction before signing it.
• Rehearse recovery and key compromise, not only normal use.

Our guide to private key management covers key tiers, custody options and ceremonies.

Offchain Systems and People

Frontends and infrastructure

Users and signers reach the chain through domains, web apps, packages and cloud accounts. Change any of them, and people sign what the attacker wants.

On April 14, 2026, an attacker who deceived the .fi registry took cow.fi and ran a phishing site for about six hours. CoW's team estimates about 1.2M USDC was taken from users.

• Lock registrar and DNS accounts, and alert on any change.
• Pin dependencies, and control who can publish packages and builds.
• Give cloud roles least privilege, and trace every path to a signing key.
• Pentest the systems that build, relay or sign transactions.

People and process

People hold the keys, logins and approvals, so attackers often go through them first.

Drift lost about $285M on April 1, 2026. Chainalysis reports that people posing as a trading firm spent months building trust with contributors.

They then got Security Council members to pre-sign transactions that handed over admin control. Days earlier, Drift had moved to a 2-of-5 multisig with no timelock.

Binance's breach also began with a person. It says a fake recruiter got an engineer to download a malicious code repository onto a work computer.

• Use hardware security keys or passkeys on every critical account.
• Ban pre-signed approvals for admin actions, and add a timelock.
• Give signers dedicated devices, and train them to stop on anything they cannot decode.
• Verify identity through hiring and onboarding, as the FBI advises.
• Decide who can pause what, and rehearse it.

For the whole surface around the contracts, read what offchain security covers.

Building the Risk Register

The map becomes useful once every row has an owner and a number. For each layer you depend on, record:

• Dependencies: every chain, bridge, oracle, custodian, node provider and vendor.
• Owner: one named person per key, domain, cloud account and contract.
• Worst case: what one key, bug or bridge failure could move, in dollars.
• Controls: one that prevents the failure and one that detects it.
• Evidence: the audit, pentest, review or drill that tested the control, with a date.

Review the register whenever you add a chain, bridge, vendor or signer. Each one adds a row.

How Guardian Helps

Guardian's institutional practice covers these layers in three parts:

• Advisory: custody, signing, chains, bridges and contract design, while they are still decisions.
• Smart contract audits: two competing teams, one manual and one AI-driven, with invariant fuzzing beneath both.
• Pentests: infrastructure, web apps, APIs, SDKs and browser extensions.

An OpSec audit maps every path to your funds, and who can walk it.

Frequently Asked Questions

What are the main security risks of blockchain technology?

They sit in six layers: consensus and network, smart contracts, bridges, keys and signing, frontends and infrastructure, and people and process. By value, compromised keys, signers and offchain systems cause most losses. Contract bugs cause most incidents.

Is blockchain technology itself secure?

Large chains have been hard to attack at the consensus layer, but small ones have fallen: Ethereum Classic suffered three 51% attacks in one month in 2020. Most losses happen in the layers around the chain.

How should an organization assess blockchain security risk?

List every chain, bridge, custodian and vendor you depend on. Give each risk an owner, a worst-case loss and controls that prevent and detect it. Test them with audits, pentests and drills.

Does a smart contract audit cover these risks?

Only one layer. An audit reviews contract code at a given commit. Keys, signers, bridge configuration, nodes, cloud, domains and staff need their own controls, testing and monitoring.

Sources

• Guardian: Onchain vs Offchain Attacks, Where Hack Losses Came From (November 2026)
• The Block: Ethereum Classic Suffers Another 51% Attack in Five Days (August 6, 2020)
• CoinDesk: Ethereum Classic Hit by Third 51% Attack in a Month (August 29, 2020)
• Bitcoin Core: CVE-2018-17144 Full Disclosure (September 20, 2018)
• Rekt: Cetus, Rekt (May 23, 2025)
• LayerZero: KelpDAO Incident Statement (April 19, 2026)
• TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History (October 29, 2026)
• Binance: 29 October 2026 Binance Security Incident, Initial Findings and Response Update (November 3, 2026)
• CoW Swap on X: POST MORTEM, Cow.fi Domain Hijack (April 16, 2026)
• CoW DAO Forum: CIP-86, Discretionary Grants Program for Victims of the cow.fi Domain Hijacking (April 23, 2026)
• Chainalysis: The Drift Protocol Hack, How Privileged Access Led to a $285 Million Loss (April 9, 2026)
• FBI (IC3): North Korean IT Workers Conducting Data Extortion (January 23, 2025)
• Guardian: Institutional Digital Asset Cybersecurity