Beyond Audits: Securing Web3 in the Age of Lazarus - Gracious Igwe

All right. Hello everyone. GMGM everybody. Yeah. Um my name is Gracious and um I'm a security analyst and also a security researcher.

Um I'm very pleased and excited to be here and it's an it's an honor to be standing here um speaking to you guys about um web through security. So, um, like I said, I'm a security analyst. I work at the Security Alliance, also known as SEAL. And, um, we're a nonprofit cryptonative security collective. Okay.

Cryptonative um, security collective dedicated to protecting web 3 protocols through rapid response, um, collaboration and, um, shared intelligence. So today I'm going to be speaking about securing web 3 beyond audits and um the top the title of my topic is beyond audits securing web 3 in the age of Lazarus. So my reason for giving this talk is because I do not believe that smart contract audits are sufficient because despite all the efforts all the audits and all the money we've poured into security um we are still losing billions to to hacks and attacks. So I'm going to tell you why in my opinion I do not think that smart contract audits are enough for this space. So let's get down to business.

Uh yeah, the numbers don't lie. The numbers we're seeing in 2025 are unprecedented. Um in the first half of 2025, Web 3 recorded approximately $3.1 billion in losses to hacks. And um what is interesting is that this is this is already more than all the losses that that was recorded in the year 2024.

And interestingly 60% of those losses were from the by bits um February 2025 hack the $ 1.5 billion bybit breach. Now let's take a look at the attack vectors. We have control hijacking which um accounted for $1.7 billion in losses and then fishing attacks which accounted for $410 million in losses.

So together these figures imply that web two um attack vectors web two attack vectors are dominating smart contract exploits right in the web two security space. So the question is not if another attack is going to happen is when and how it's going to happen and if we are prepared to tackle it because despite the widespread awareness of this problem um the ecosystem is still fundamentally vulnerable. All right. So let's move on. So that brings us um to a critical misconception in the indust in the industry which is that audits equate to compre comprehensive security.

But then the data says or rather statistics says otherwise because 92% of hacked smart contracts in 2025 had undergone some form of a audits um undermining the belief that an audit badge means a protocol is completely secure. So if audits are supposed to be our safety net then why are we still falling through the cracks? Well, the reason is because we've created um a sort of we've created an ecosystem where the appearance of security takes precedence over actual security measures. When you look at current auditing practices, um they are limited by their narrow focus on code, one-time assessments, inconsistent quality and inability to dictate human driven threats. And that uh leads us to the question of who audits the auditors and are there even quality um standards or are there even standards in the space that ensures that we get quality audits and assessments right in this space.

So moving on now this guy um uh now this guy Bruce Schneider he observed that amateurs hack systems but professionals hack people and I think that this distinction is important in understanding the current web 3 attack landscape. So if you're if you're um active in the web 3 security space and you're someone that regularly reads audit reports and postmortms, you would notice that recently um reports are dominated by um human based or human layer based vulnerabilities. But as at 2022 and 2023 reports were dominated by code based vulnerabilities. So in recent years attacks are driven by operational failures and social engineering have become significantly more common within the space. By 2024 high value attacks succeeded primarily through compromising human and organizational layers rather than technical exploits.

So basically the tech is solid is is is good but the human factor is what is the actual problem. is very vulnerable and is susceptible to attacks and attackers know this. They recognize this and um they recognize this and they're taking advantage of that. So Lazarus, how many of us know about the Lazarus group? Please raise up your hand.

Okay. So the Lazarus group has executed more than 40 attacks resulting in theft exceeding $3 billion in the defy space. Their strength extends beyond technical vulnerabilities to understanding human behavior. And they don't just break code, they break trust in the entire system. There's something I refer to as the decentralization illusion.

This is this means that we all know that the tech is decentralized and it's solid. But then the humans operating this tech are centralized and they are vulnerable and this creates a kind of um disconnect and creates an opportunity for attacks and hacks to happen. So how does the Lazarus group operate? We have insider positioning. Uh they apply for legitimate jobs.

Sorry this is okay. So they apply for legitimate jobs with fabricated credentials. They work as contractors through consulting firms. They become trusted community members in governance roles. They maintain cover for months and even years before attacking.

Then we have social engineering multi-platform campaigns. Um they impersonate executives. They use deep fake technology for attacks. They create artificial urgency. And then we have supply chain infiltration.

They compromise development tools, libraries and frameworks. They infiltrate communication platforms and community spaces. They target service providers and contribute malicious code to open source projects. And then lastly, we have um long-term relationship building. So they create fake LinkedIn profiles.

They engage in technical discussions. They offer job collaborations and they extract organizational intelligence through conversations. Then we have notable incidents um the running bridge hack and the harmony bridge hack. So the running bridge hack um Lazarus created fake developer profiles and they spearfished the employees of the running bridge and then they gained access to validator nodes and drained about $624 million. While for the Harmony Bridge hack, they used deep fake enabled video calls to gain trust and eventually walked away with $100 million.

Now it's interesting to know that neither of these hacks were caused by code bugs but they were as a result of human and organizational failures and both of these um projects or rather protocols had both of these protocols had passed multiple security audits but then they suffered massive breaches and this reveals a critical gap in traditional security approaches. There's something referred to as the audit blind spot. So you build your project, you get an audit, but then an audit is not going to tell you that um your key storage practices are below par. Your audit is not going to tell you that it's not going to prepare you for a social engineering attack. Your audit is not going to tell you that your employee is a North Korean state actor.

So that is referred to as the audit blind spot, which is comprehensive code review but paired with complete operational blind spot. Then the decentralization paradox is also a factor. Um both protocols promoted decentralization as a security strength but in practice it did not eliminate human risk rather it spread it across potential attack vectors. And then lastly we have the human factor. Um Lazarus succeeded by exploiting human vulnerabilities rather than breaking code demonstrating that true operational security must address both technical systems and human behavior.

All right. So, I've been talking about operational security. Operational security. What exactly is operational security? Well, OBSC involves implementing um proactive procedures and practices to protect security assets from attacks.

So, basically, OBSC is just like treating the operational and human layer just as important as you treat the technical layer, which is your code and smart contracts. Um I think it's important to distinguish OPSSE from related security disciplines such as secops and and abscops which is security operations is primarily focused on reactive security measures including real-time monitoring threat detection and incident response protocols and then appsec involves designing building and maintaining um secure code through bug bounties audit and bounces again. So secops secops is like reactive is the thing that you do after you've deployed your project. So like you do um real time monitoring threat detection and incident response and then apps is like the ones we all know which is um code audits writing secure code and so on and so forth. So most web securities f resources are focused on the absc factor but then operational security failures cause the majority of losses highlighting a critical misalignment that needs correction.

Then we have the obsc framework. The obsc framework is basically um operational security measures that you can implement. This is not comprehensive like this is not everything. These are just like the key ones that I selected. So we have key management which is the secure handling of private keys and signing procedures, endpoint security, securing individual devices and machines, personnel security, education and human factor management, application security, securing applications and interfaces, code management, secure development and deployment of code and then access control, managing your infrastructure access and permissions to ensure that only authorized personnel have access to your system.

So here you can see a real-time monitoring dashboard for web security in incidents and it was built by chain chain lights. The name is lumos. So it it just sums up everything I'm talking about since um 95% of emergency incidents in April 2025 were caused by basic avoidable security lapses. So web two attack vectors such as social engineering, key leaks, supply chain compromises accounted for over three times the value stolen by smart contract B compared to smart contract BS. And then from January 2023 till date, control hijacking led to 31 billion in losses.

But then in contrast, um smart contract vulnerabilities accounted for just $900 million in losses. And then we have major cases um studies. Um there's the by bit hack I talked about earlier. So North Korean hackers evolved from targeting individual protocols to critical infrastructure and the bybit incident compromised the safe wallets safe wallet platform used by thousands of D5 users. So what happened was in the by bit incident um North Korean hackers didn't just they didn't just target um individual protocols rather they targeted the core web 3 infrastructure which is the safe wallet platform and by bits being the biggest users of the safe wallet platform were actually the victims of the hack.

Then we have Radiance Capital. Um, attackers build credibility over extended periods before striking. The Radiance hack involved a fake security researcher who spent a year establishing trust before deploying malware. So this was what I talked about earlier where I said your code is not going to tell you whether your employee is a North Korean state actor. In the Radiance Capital hack, a North Korean state um state actor had sent a file containing malware to the Radiance Capital team and then when they when they clicked on the file, it affected their machines and then um they were able to North Korea was able to steal or join their funds.

And then we have the Waz X um hack. Attackers bypass hardware security wallet security by manipulating what users see before signing. And then victims unknowingly authorized malicious transactions while believing they are legitimate. So we have personal obsc for developers and users. Um effective operational security starts at the personal level.

Um it includes preventing information leakage, sensitive information like travel schedules and row updates. Can provide openings for social engineering attacks. Then secure physical environments. Um extend security to development spaces and communications channels. And then rigorous key management, protect against um protect against social engineering attacks and physical access vulnerabilities.

And lastly, we have social media awareness. Attackers build detailed profiles by aggregating information from multiple online resources. Moving on, we have OBSC at the organizational level which includes vetting your hires like thorough screening process for team members or your new employees. Then cultural balance, navigating security needs, insider threats, managing risk from compromised team members, infrastructure hardening, strengthening systems against potential vulnerabilities, team protocols, and lastly, secure communication and then obsc at the protocol level. So at the protocol level, OBSC involves more than just deploying multi-ig wallets.

It requires clear process for governance and treasury protection. So for those of us in governance um these are the measures that you can take to ensure that um your operational security is solid. We have multi- signature security um effective multiig requires geographic distribution operational independence and um so on and so forth. Governance controls prevent attacks through snapshot based voting corum requirements and monitoring. We have treasure protection um time locks implementation incident response and admin key management.

All right. So security as a life cycle. This is like the crux of everything I've been talking about since um web two security must be approached as a comprehensive life cycle. This means that you must work towards approaching sec web security as a continum that is as a continuous process. It's not something that you just do once and then you forget about it.

You have to continue doing it at every stage of your project. So we have pre-eployment security which includes um threat modeling, secure development practices, comprehensive testing, offset planning and incident response. Then we have deployment security which includes real-time monitoring, anomaly detection, community alerting mechanisms, response team and continuous threat intelligence. And lastly we have post deployment security which includes um operational security systemic improvements and regular assessments. Then the continuous approach versus point in time audits.

So the continuous approach is just like continuous approach to security versus just having an audit once and forgetting about it. So the um point in time audits are like the traditional audit models and they force teams to react only after something has happened or after an attack has happened and then it often takes days to to respond. So like there's usually a delay after like something has happened and then in that process the attacker might escape with the money and the money you not be able to recover it and so on and so forth. But with a continuous security approach in place, it involves constant monitoring, regular um expert reviews and threat detection to catch problems early and respond faster. Then we have for point in time audits.

They quickly become outdated because security is always evolving. It's not something that is um it's is a constant, right? It's always changing. So like protocols, updates and threats evolve leaving systems vulnerable to new risk. Then shared responsibility, the continuous approach brings users into the security loop through bug bounties making security a collaborative effort.

So the mind mindset shifts. So as we're as we try to adopt um security the continuous security approach we need to change the way we think about security. So instead of thinking oh we got audited we are secure we don't need to do anything else you start thinking that oh we are continuously securing our system instead of just saying oh security is just a requirement then you start saying security is part of how we operate security is part of our infrastructure you know then audit prevents attacks to continuous vigilance prevents attacks all right so key takeaways security is not a product it's a process yes um constant monitoring, continuous vigilance performs point in time security checks beyond audits. Audits provide a necessary foundation but they cannot address all the vulnerabilities and then human vulnerability. Obsc is now the primary attack vector and um social engineering compromises attack even the most sophisticated smart contracts.

All right. And so how you can contribute for developers and teams move beyond smart contract audits to include OBSC assessments. Um establish multi-IG management procedures. Create incident response plans. Implement continuous monitoring.

Contribute to open source security tools for investors. Look beyond audit badges to assess OBS practices. Evaluate multi-IG um configurations and and key management procedures and then support the development of security tools. And then you as the user you can report potential security threats to the community, contribute to open source security resources and verify protocol security claims rather than relying on audit badges. So at the end of the day, security is everyone's responsibility and um we must come together to ensure that uh we are able to um shift security from where it is right now to a more continuous and human um centric security culture in the web three space.

You have questions.