While smart contract exploits have slowed, phishing remains a persistent and evolving threat. PeckShield data show that losses tied to wallet drainers have dropped sharply in 2025 — from $494 million to $83.85 million — but social engineering attacks continue to target users directly rather than protocol code.

Security experts warn that attackers are increasingly “hacking the human” instead of the contract, exploiting trust and private key mismanagement. Institutions and high-net-worth holders are urged to adopt multi-signature cold storage solutions and enforce strict wallet security practices. As the ecosystem matures, the battle between improving defenses and increasingly sophisticated scams remains high-stakes.