Web3 Security: Best Practices for Onchain Teams

By the Guardian team Updated November 2026 6 min read

Quick answer. Secure five layers: audit and fuzz the contracts, split admin keys across timelocked multisigs, pentest offchain systems, train people against phishing, and monitor with a tested pause. One audit covers one commit, not the whole system.

Watch: Web3 Security: Best Practices for Onchain Teams 1:41

Video transcript

By value, most web3 hack losses this year were not code bugs. Protocols have five layers, and an attacker needs only one.

In Guardian's count of DefiLlama data, 82 percent of 2026 hack losses to November 2 came from offchain attacks.

Picture a protocol as five layers: contracts, keys, offchain infrastructure, people, and monitoring.

For the contracts, fuzz your invariants, then get an independent audit and a fix review. But an audit covers one commit, not the whole system.

At Drift in April 2026, about 285 million dollars left the vaults after attackers got council members to pre-sign transactions handing over admin control, Chainalysis reports.

The Security Alliance says split admin powers, give each signer a hardware wallet, add a mandatory delay and verify calldata. After Drift, add a rule: no pre-signed approvals.

Next, offchain systems and people. Lock the registrar and DNS, pin dependencies, pentest what builds or signs transactions, and use hardware security keys everywhere.

Then monitor everything. The Security Alliance's rule: every alert maps to a documented response, usually a pause you have rehearsed.

You do not need every control on day one. Add them as value at risk grows, and fill gaps for your current stage first.

Guardian covers all five layers, and over 150 teams trust it with their contracts. Read the full guide or talk to Guardian at guardian.security.

Web3 security is everything that keeps a protocol's funds from being stolen or locked. The code is only one part of it.

In Guardian's count of DefiLlama data, 82% of 2026 hack losses to November 2 came from offchain attacks on keys, signers, infrastructure and people, under DefiLlama's labels.

This guide maps the five layers, the controls that matter most in each, and the Resource Hub guide that goes deeper. A roadmap by stage closes it.

What Web3 Security Covers

Think of a protocol as five layers. An attacker needs only one of them.

Layer	What goes wrong	Core controls
Smart contracts	Logic, accounting, oracle and access control bugs	Invariants, fuzzing, audits, bounties
Keys and admin powers	Upgrades or treasury moves by the wrong hands	Split multisigs, timelocks, verified signing
Offchain infrastructure	Frontends, cloud, pipelines, keepers and domains taken over	Pentests, locked registrars, pinned dependencies
People	Phished staff, deceived signers, fraudulent hires	Hardware-key MFA, least privilege, hiring checks
Monitoring and response	Attacks and bad changes caught too late	Alerts with owners, a tested pause

Code exploits are most incidents, but a minority of dollars. Our crypto hack statistics break losses down by vector, target and chain.

Smart Contracts

Start with the code that holds the funds. An audit reviews a fixed scope at one commit, so it is one layer, not the whole defense.

Write the trust model first: every privileged role, oracle and dependency.
Write invariants for accounting, rounding and solvency, and fuzz them.
Run static analyzers such as Slither and Aderyn before each pull request merges.
Get an independent audit with a written scope, then a review of the fixes.
Size a bug bounty to the funds at stake, as ethereum.org advises.
Match the deployed bytecode to the audited commit before deposits arrive.
Review every upgrade to the same standard as the original code.

Ethereum.org is blunt: smart contract audits "won't catch every bug". Our smart contract security guide sets out seven layers and what each one catches.

Keys and Admin Powers

Next, the keys. Whoever can upgrade the contracts or move treasury funds can drain a protocol without any code bug.

Drift shows how. On April 1, 2026, about $285M left its vaults after attackers got Security Council members to pre-sign transactions that handed over admin control, according to Chainalysis.

Days earlier, Drift had moved to a new 2-of-5 council multisig with no timelock. Nothing slowed the transactions down.

DefiLlama records the loss as $295M, the figure in our hack statistics. Our Drift write-up sets out the full timeline.

The Security Alliance (SEAL) sets a baseline for protocol multisigs:

Split powers: protocols "should not consolidate all admin privileges into a single multisig."
At least three signers and a 50% signing threshold.
A hardware wallet for every signer, used from a dedicated or hardened device.
A mandatory delay between approving a transaction and executing it.
Verify the calldata, not just the hashes, before every signature.

Add one rule of your own after Drift: no pre-signed approvals for admin actions.

Our multisig best practices turn SEAL's framework into a full signer policy, with thresholds and timelocks by function.

Infrastructure and People

Offchain systems

Then the systems around the contracts: frontends, APIs, cloud, build pipelines, keepers and domains. Each can change what users sign or what keys do.

At Bybit in February 2025, Safe said the attack came through a compromised Safe{Wallet} developer machine, which led to a disguised malicious transaction. The FBI attributes the roughly $1.5B theft to North Korea.

On April 14, 2026, attackers socially engineered CoW Swap's registrar and held the cow.fi domain for about 4.5 hours. CoW's team estimates about 1.2M USDC was taken from users.

Inventory every domain, cloud account, repository, keeper and vendor, each with an owner.
Lock the registrar and DNS, and alert on any change.
Pin dependencies, and control who can publish builds, SDKs and extensions.
Pentest the systems that build, relay or sign transactions, then retest the fixes.

Start with what offchain security covers, then how a web3 pentest is scoped.

People and OpSec

People hold the keys, the cloud logins and the registrar accounts. Attackers go after them directly.

At Drift, Chainalysis reports, attackers posed as a quantitative trading firm and built relationships with contributors over months.

In January 2025, the FBI warned that North Korean IT workers hired remotely have stolen code and data, then held it for ransom.

Use passkeys or hardware security keys on cloud, code host, registrar and email.
Drop SMS and email codes. SEAL: "Stay away from text and email as MFA methods."
Grant least privilege, and remove access the day someone leaves.
Verify identity through hiring and onboarding, in person where you can, as the FBI advises.
Watch for code repositories copied to personal accounts.
Train signers to stop on any transaction they cannot decode, whoever sent it.

Monitoring and Response

Finally, watch it all. The live system keeps changing after the audit: roles get granted, proxies upgraded and signers rotated.

SEAL's monitoring rule: "Every alert must map to a concrete, documented response." For contracts, that usually means a pause or circuit breaker.

Alert on role, ownership, upgrade, signer and threshold changes.
Watch large transfers, mints and burns, and oracle deviations.
Give every alert an owner, including nights and weekends.
Decide who can pause, with which key, and rehearse it on a fork.
Know who to call. SEAL 911 offers 24/7 incident response for the crypto ecosystem.

Our guide to onchain monitoring lists the events to watch and compares building, buying a platform and buying a service.

A Roadmap by Stage

Not every control is needed on day one. Add them as the value at risk grows.

Stage	Code	Keys and people	Infrastructure and monitoring
Build	Trust model, tests, invariants, static analysis in CI	Hardware-key MFA on every account	Inventory of domains, cloud and repositories
Before mainnet	Audit with a written scope, then a fix review	Split multisigs, timelocks, hardware wallets	Pentest of the app, APIs and cloud
Launch	Bytecode matched to the audited commit; a bug bounty	Signers verify calldata on the device	Monitoring live before deposits; a tested pause
Growth	Every upgrade reviewed to the same standard	Signer rotation and phishing drills	Continuous testing and around-the-clock response

Use the table as your checklist. Anything still missing for your current stage comes first.

How Guardian Helps

Guardian covers all five layers, from the first audit to operations after launch. More than 150 teams trust Guardian with their contracts.

Code: Vanguard puts two competing teams on one scope, one manual and one AI-driven, with invariant fuzzing beneath both.
Offchain: infrastructure, web app, API, browser extension and offchain automation pentests, an SDK audit and an OpSec audit.
Keys: Managed Security maps every path to your funds and reviews every multisig transaction before it is signed.
Monitoring: Guardian monitors your contracts on every block. When something fires, a Guardian engineer responds.

See how the pieces fit together for onchain teams.

Frequently Asked Questions

What is web3 security?

It is the work of protecting a protocol's funds and users across its smart contracts, admin keys, offchain infrastructure and people, before and after launch. It combines audits, key management, pentests, operational security and monitoring.

What causes most web3 hack losses?

By value, offchain attacks. In Guardian's count of DefiLlama data, keys, signers, infrastructure and people caused 82% of 2026 losses to November 2, under DefiLlama's labels. Code exploits are most incidents but a minority of dollars.

Is a smart contract audit enough for web3 security?

No. An audit reviews contract code at one commit. Keys, signers, cloud, frontends and later upgrades need their own controls: a multisig policy, pentests, an OpSec review and monitoring.

What should a web3 security checklist include?

Invariants and an audit with a fix review; split, timelocked multisigs with hardware wallets; pentests of offchain systems; phishing-resistant MFA for staff; and monitoring with a tested pause before deposits arrive.

Sources

Secure every layer with Guardian

Guardian audits the code, pentests the systems around it, and watches the keys and contracts after launch.

Talk to Guardian Explore security for onchain teams