Why Companies Struggle to Combat Social Engineering Attacks

In recent times, the rise of social engineering attacks has put many companies at risk, particularly in the cryptocurrency industry. Despite spending significant amounts on cybersecurity, organizations continue to fall victim to tactics that exploit human behavior rather than technology. Effective solutions must integrate operational security and staff training to combat these attacks.

Key Takeaways

Many of the largest exploits in cryptocurrency stem from social engineering, targeting individuals rather than systems.
Social engineering is responsible for roughly 60% of data breaches, with humans being the main vulnerability.
The irreversible nature of cryptocurrency transactions means even a small error can lead to devastating losses.
Companies must shift their approach to cybersecurity by investing in operational security and training employees to recognize and combat phishing attacks.
As technology evolves, social engineering tactics will only become more sophisticated, emphasizing the need for stronger defenses.

Social engineering will not disappear, but we can make it far less effective and far less catastrophic when attacks occur.

The Human Factor in Cybersecurity

Last year, the primary cause behind numerous significant exploits in the crypto space was human error. Recently, Ledger warned its users to temporarily halt on-chain activities due to malicious packages introduced by duped npm maintainers. Workday also revealed a social-engineering attack that accessed information in a third-party Customer Relationship Management (CRM) system. Meanwhile, North Korea-linked operators have persisted in luring individuals with fake job offers to deliver malware.

Despite countless resources allocated to cybersecurity, companies often fall prey to basic social engineering schemes. This occurs because organizations invest heavily in technical solutions while overlooking essential aspects like operational security and device management. The transition to on-chain financial activities heightens the risk, exposing weaknesses in digital infrastructure.

Social Engineering: A Critical Weakness

According to Verizon’s 2025 Data Breach Investigations Report, nearly 60% of data breaches relate to the "human element" of cybersecurity—this includes phishing, credential theft, and simple mistakes. Social engineering is effective because it focuses on manipulating individuals, exploiting their trust and routine behaviors. These tactics cannot be mitigated through coding audits and are not readily defendable with existing automated security tools. Security measures such as code reviews often fail to prevent an employee from unwittingly approving a fraudulent request disguised as a legitimate one or downloading a deceptive software update.

Even highly skilled technical teams are vulnerable, showcasing the universal nature of human weakness, which enables social engineering to result in real incidents.

The Cryptocurrency Risk Factor

In the world of cryptocurrency, where transactions are irreversible, the risks associated with social engineering increase significantly. Compromising essential security keys—like a seed phrase or API token—can be as serious as breaking into a bank vault. Once funds transfer occurs within the blockchain, recovering them can often prove impossible. A single lapse in device security or mishandling of keys could deplete assets. In the decentralized environment of Web3, support options are sparse, leaving users to navigate issues independently.

Hackers, particularly those affiliated with state-backed organizations, have recognized the efficacy of social engineering and adjusted their tactics accordingly. Groups such as North Korea's Lazarus Group leverage social engineering through fake job offers, malicious files, and tailored phishing attacks that exploit human foibles. The simplicity and effectiveness of these tactics allow attackers to repeatedly capitalize on similar strategies rather than seeking new vulnerabilities.

The Need for Operational Security Investments

Many organizations still regard security as a compliance requirement, a misconception bolstered by lenient regulations. Despite passing audits, companies frequently harbor significant operational risks, such as storing administrative keys on personal devices or sharing credentials through insecure channels.

To address this lack of discipline, organizations must enforce strict operational security measures. This includes utilizing managed devices, implementing robust endpoint protection, and encrypting data across the board. Utilizing password managers and strong multi-factor authentication can also improve security. Although these measures may not eliminate risks entirely, they significantly bolster defenses against social engineering incidents and mitigate their impacts.

Training for employees is crucial—individuals, rather than cybersecurity teams, serve as the first line of defense against social engineering. Companies should prioritize educating their staff to identify potential phishing attempts and adhere to safe data handling practices.

It’s vital to recognize that expecting firms to enforce stringent cybersecurity protocols voluntarily is unrealistic; regulatory bodies need to establish enforceable standards that ensure security becomes mandatory rather than optional. Compliance frameworks should extend beyond mere documentation to require verified evidence of secure practices, such as periodic access reviews and simulated phishing assessments. Without stricter regulations, organizations will likely prioritize superficial compliance over genuine security measures.

The Growing Threat of Social Engineering

Investing heavily in operational security is crucial now due to the rapidly increasing frequency of social engineering attacks. The advent of generative AI has transformed the landscape of deception. Attackers can now personalize and automate phishing campaigns on a large scale, targeting thousands of businesses with minimal additional effort. With just a few clicks, attackers can tailor phishing attempts to include personal details, making their scams appear genuine.

Additionally, AI accelerates the reconnaissance process. Hackers can efficiently gather information from public sources, leaked data, and open-source intelligence, creating detailed profiles of potential victims, which enhances the effectiveness of their attacks.

Reducing Attack Rates

Social engineering prevails in environments where implicit trust and convenience supersede the need for verification. Organizations must adopt a more defensive approach and assume they are always at risk from social engineering threats.

Employing zero-trust principles in daily operations and implementing operational security awareness as a company-wide practice are essential steps. Regular training on operations security can empower employees to identify and combat social engineering tactics effectively.

Lastly, companies should assess and fortify areas of trust within their operations—these are the points where attackers could impersonate employees or systems. Although social engineering is unlikely to vanish entirely, stronger defenses can significantly reduce its effectiveness and associated risks. As the industry fortifies against these persistent threats, social engineering will become less appealing for hackers, leading to a potential decline in attack rates.