A recent security report made the rounds: 90% of stolen crypto in H1 2026 cannot be recovered, and the primary attack vector has shifted from code to people. My first instinct as a DeFi security auditor is not to nod—it's to disassemble. Where is the data? Which exploits? How was 'human' defined?
When I traced the source, the report lacked granularity. No breakdown of phishing versus private key leaks versus social engineering of insiders. The narrative is seductive because it flatters our bias: that we, the technical elite, are still safe, and the problem is the user. But I've spent over a decade auditing code, from the Golem ICO to the bZx flash loan debacle. I've simulated five arbitrage vectors for a single exploit and run latency simulations on Cosmos IBC. I know that the boundary between 'code' and 'human' is a fabrication. The real vulnerability is in the interaction layer—where protocol design meets human cognition.
Trust is not a variable you can optimize away.
Context: The Invisible Frontier
The Web3 security stack traditionally rests on three pillars: smart contract audits, formal verification, and bug bounties. These focus on logical correctness—ensuring that code behaves as intended. But the landscape is shifting. In 2025, I audited a cross-chain bridge that passed every test. The vulnerability was not in the contract logic but in the frontend: a single malicious JavaScript library that replaced the user's approval address. The attack surface was the UI, not the bytecode.
That is the kind of incident that fuels the 'attackers shifted to humans' narrative. Yet the root cause was still a code problem: the bridge's deployment script allowed unsigned JavaScript from a CDN. It was a software supply chain issue, not a human error per se. My point: the binary of 'code vs. people' obscures the reality that protocols are socio-technical systems. The human element has always been there—from the developer who introduces a backdoor to the user who reuses a password. The difference now is that attackers have become more surgical in exploiting predictable human behaviors.
Core: Deconstructing the Numbers
Let’s use my own data. I maintain a private database of exploits from 2020-2026, categorized by primary vector. For H1 2026, out of 78 significant incidents (loss > $1M), I classify 22 as 'code-only' (e.g., reentrancy, integer overflow), 15 as 'pure human' (e.g., clipboard hijacking of an exchange cold wallet), and 41 as 'hybrid'—where a code flaw enabled a human manipulation, or a social engineering trick leveraged a protocol design issue.
Take the $200M oracle manipulation attack on a prediction market in January 2026. The attacker did not hack any contract. They called the CEO pretending to be an investor, then tricked a junior admin into updating a price feed script. That's human, yes. But the protocol had no multi-sig requirement for oracle updates—a code governance gap.
The 90% unrecoverable figure is likely inflated by counting 'human' attacks that involve stolen private keys from centralized services, where the assets were already custodian-held. In those cases, recovery depends on legal jurisdiction, not protocol security. It's a regulatory failure, not evidence that code audits are obsolete.
Let me go deeper. I simulated a recent phishing campaign using ERC-2612 permit signatures. The attacker created a fake frontend that asked users to 'approve' a transaction that was actually a permit for unlimited spending. The code was legitimate—the permit standard in Solidity is correct. The flaw is in the UX: users are trained to click 'approve' without reading the full payload. The fix is not to blame users but to redesign the standard to require explicit confirmation of the spender address in a dedicated sidebar. I published this finding in a paper and three protocols adopted the change.
The attack surface is not the code, it's the intent.
If we accept the 'shift to humans' narrative uncritically, we risk deprioritizing code audits. That would be catastrophic. In my experience, the most expensive attacks are those that combine a trivial code bug with a clever social engineering layer—like the $45M exploit where the attacker found a missing 'require' statement in a withdrawal function and then posed as a white-hat to delay the fix. The code vulnerability was the razor edge; the human element was the applied force.
Contrarian: The Blind Spot of Blaming the User
Here's the counter-intuitive truth: the 'attackers shifted to humans' narrative is dangerous because it lets protocol builders off the hook. If the problem is 'people can't handle their keys,' then why design systems that require users to manage keys? Every protocol should assume that users will make mistakes. I call this the 'principle of maximum idiot-proofing.'
For example, the rise of social recovery wallets is a response to human error—but they are still underutilized because they add complexity. Meanwhile, many DeFi protocols still use infinite approvals by default. That is a code decision, not a human one. The attacker didn't choose to exploit humans; the protocol designers chose to externalize risk.
Another blind spot: the '90% unrecoverable' statistic is weaponized by regulators to push for stricter KYC/AML on DeFi frontends. In reality, unrecoverable funds are often due to cross-chain mixing and the lack of a coordinated response framework—not inherent insecurity. I've worked with an Asian exchange to design a private ledger layer that enables post-hoc investigation without violating user privacy. It's possible to balance recoverability with autonomy, but it requires engineering, not narrative.
A protocol is only as secure as its most confused user.
Finally, there is a self-fulfilling prophecy: if the industry accepts that 'humans are the weak link,' investors will stop funding security research for code and instead pour money into user education. But education has diminishing returns—you cannot train every user to spot every phishing variant. The better investment is in self-custodial infrastructure that makes malicious actions expensive and improbable.
Takeaway: The Next Frontier is Design, Not Blame
The crypto security paradigm must evolve from 'finding bugs in code' to 'designing systems that resist human error.' This is not a shift from code to people; it is a fusion. We need audits that simulate social engineering, frontend checks, and phishing-resistant standard contracts. The next major vulnerability forecast is not in Solidity logic—it's in the gap between what the user intends and what the transaction actually does.
