Most losses in the Web3 ecosystem are caused not by faulty code, but by human error, according to a new report from blockchain security firm Kerberus.
The research, titled “The Human Factor: Real-Time Protection Is the Unsung Layer of Web3 Cybersecurity”, found that 44% of crypto thefts stem from private key mismanagement, while broader cybersecurity studies indicate 60% of breaches involve human error.
Despite billions spent on audits, bug bounties, and blockchain monitoring, the report says the industry’s investments often fail to protect users at the moment they are most vulnerable. “Social engineering drives the majority of real losses because users are expected to identify threats they have no way to detect,” said Alex Katz, CEO of Kerberus. “Attacks happen during distracted or high-stress moments, and audits can’t prevent what happens in those seconds.”
Current Web3 Security Focus vs. Real-World Vulnerabilities
The study found that the current Web3 security infrastructure focuses heavily on code integrity. Billions have been invested in smart contract audits, bug bounties, and blockchain monitoring. While these tools verify well-known vulnerabilities in code and overall technical quality, they operate outside the window where users actually lose funds. By contrast, traditional finance systems automatically detect and block fraudulent transactions. Credit card companies, for example, do not rely on consumers to spot fraud—they prevent it in real time.
Kerberus examined 61 leading Web3 providers to understand when and how their solutions intervene. The analysis found that 87% offer preventative services such as code audits and forensic analysis. Only 13% actively block threats in real time at the transaction level. Companies were categorized based on publicly available information about their products, deployment models, and whether they prevent attacks before users approve transactions or merely detect them afterward.
While preventative security is important for measuring and mitigating risk, industry data shows that 90% of exploited smart contracts had already passed security audits. Meanwhile, 44% of crypto thefts in 2024 involved private key mismanagement, underscoring that a large share of losses occur outside the scope of code verification.
Even extensive security training has been found to be insufficient at times, the report notes. Phishing click rates remain between 7% and 15%, as users must repeatedly verify URLs, check contract addresses, approve token permissions, and interpret technical warnings—tasks that create cognitive overload and increase the likelihood of mistakes.
The Role of Social Engineering and Real-Time Solutions
Kerberus CTO Danor Cohen emphasized that social engineering exploits these gaps. “The transaction often appears legitimate on-chain,” he said. “Traditional security tools can’t distinguish between what a user intends to do and what an attacker manipulates them into doing. Real-Time solutions need to interpret behavioral signals and analyze transactions at the wallet level.”
High-profile cases illustrate the risk. In April 2025, a U.S. investor lost $330 million in Bitcoin through a social engineering attack, despite no breach of the wallet or underlying code. Such incidents can discourage potential users and institutions from entering the market, creating barriers to mainstream adoption.
Report Findings and Implications
Kerberus conducted the research to highlight the discrepancy between where the industry’s security focus is directed and where users actually lose funds. The full report, including methodology and detailed findings, is available.