Experts have recorded an increase in attacks on users' crypto wallets

In the first quarter of 2026, attackers began to focus less on individual large targets and attack different segments of the crypto ecosystem more often. The main focus has shifted to private users, as well as vulnerabilities in smart contracts and when interacting with services. This is stated in the report of the AML/KYT provider SHARD, which was reviewed on May 30 by Izvestia.

DeFi services are still the main target of attacks, but their share has decreased from 78.38% to 73.17%. This indicates a wider choice of targets on the part of intruders within the framework of the crypto ecosystem. At the same time, the share of attacks on private users has increased significantly — from 13.51% to 21.95%. Experts attribute this to increased phishing, key compromise, and an increase in targeted attacks on individual crypto wallets.

The centralized services segment, on the contrary, decreased to 1.22% from 5.41% a year earlier. Such a reduction may reflect the strengthening of basic protection after major incidents in previous periods, as well as a shift in the interest of intruders towards less secure targets. The share of attacks on bridges remained stable and amounted to about 2.5%. At the same time, in 2026, for the first time, a separate category of attacks on government agencies was identified (1.22%), which indicates an expansion of the range of targets beyond the crypto industry.

Dealing with technology: second-hand gadgets are increasingly being used for DDoS attacks

Viruses deliberately infect not only laptops and smartphones, but also "smart" coffee makers and vacuum cleaners.

At the level of attack types, logical errors in smart contracts are leading (26.83% of cases). This is followed by exploits using flash loans (17.07%) and phishing with elements of social engineering (13.41%). Attacks on oracles and price data, compromise of private keys and vulnerabilities of authorization mechanisms are also recorded.

Experts note that modern cyber attacks in the crypto industry are becoming more complex and combined, combining technical vulnerabilities, economic incentives and user actions. In these circumstances, the key task for the industry is the transition from incident response to early detection of risks and the formation of a more stable protection system against the background of constantly changing threats.

On October 9, RTM Group announced that hackers had begun attacking Russian companies through smart gadgets. They began to gain access to confidential information from Russian enterprises using portable speakers, charging stations, and heated mugs.