2025 was the worst year on record for crypto hack losses, but the biggest failures did not come from smart contracts. Mitchell Amador, CEO of onchain security platform Immunefi, said the most damaging incidents were tied to Web2 operational breakdowns: passwords, private keys, compromised devices, manipulated employees, and fake support agents. The weak point, he argued, was people rather than protocol code.
In an interview with CoinDesk, Amador said that distinction matters because onchain security is still getting stronger even while overall losses continue to rise. From the perspective of DeFi and protocol code, he said, 2026 could be the best year yet for onchain security. That points to a shift in the threat model. Systems are not necessarily becoming weaker; attackers are becoming more convincing and more sophisticated.
Scams are growing faster than classic hacks
Chainalysis described the same shift from another angle in its 2026 Crypto Crime Report, released this week. According to the report, about $17 billion in crypto was lost to scams and fraud in 2025. Criminals are increasingly targeting individuals instead of infrastructure, using impersonation, social engineering, and AI tools to reach more victims.
Chainalysis said impersonation scams rose 1,400% year over year, while AI-enabled scams were 450% more profitable than traditional schemes. A recent example surfaced last week, when blockchain investigator ZachXBT revealed a social engineering theft involving $282 million in litecoin and bitcoin. The victim lost 2.05 million LTC and 1,459 BTC, which were then quickly swapped into monero through multiple instant exchanges.
As code hardens, attackers pivot to humans
Amador said exploit paths in code are becoming harder to use, which is pushing attackers toward new methods. His outlook for next year is blunt: the main attack surface in 2026 will be people. In that environment, onchain security teams and Web3 companies need to put the human factor much higher on the list.
That does not mean protocol risk has disappeared. Amador said more than 90% of projects still contain critical exploitable vulnerabilities. He also pointed to weak adoption of defensive tools across the industry. Less than 1% use firewalls, and fewer than 10% use AI detection tools. Tools exist, but use remains thin, leaving a wide gap between available defenses and actual deployment.
AI is accelerating both attack and defense
Amador expects AI to change the pace of crypto security on both sides in 2026. Defenders will lean more on AI-driven monitoring and response systems that work at machine speed. Attackers, using the same class of tools, can speed up vulnerability research, exploit development, and social engineering campaigns. The cycle gets faster, and response time shrinks.
His clearest warning was not focused on wallets or smart contracts. It was about what happens when crypto systems begin making and executing decisions on their own. Amador said onchain AI agents create a new attack surface: they can act faster and with more power than human operators, but they are also vulnerable if access paths or control layers are compromised. He said the industry is still early in learning how to secure those agents properly, and that challenge is likely to define a major part of the next security cycle.
Chainalysis data shows scammers are becoming more effective at extracting value from individuals. Immunefi’s view is that protocols are improving at resisting pure code exploits. Taken together, those signals show a security battle moving away from the chain itself and toward interfaces, corporate controls, monitoring systems, and user education.