Threat Landscape for Crypto Holders

The concept

Every crypto holder faces two fundamentally different categories of risk, and conflating them is how people get hurt. The first is custodial risk: when you leave funds on an exchange or with any third party, you are trusting that party's solvency, security engineering, and honesty. Exchange hacks (Mt. Gox, FTX) and insolvency events destroy funds that were never technically "yours" in a cryptographic sense — you held an IOU, not a key. The second is operational risk: once you self-custody, the threats shift entirely to your own behavior and environment — phishing emails, SIM-swapped phone numbers that let an attacker reset your accounts, clipboard-hijacking malware that swaps a copied wallet address for an attacker's address, and at the extreme end, physical coercion (the "$5 wrench attack") where someone threatens you directly for your keys. There's also the quiet, un-dramatic risk of simple user error: a lost seed phrase, a spilled coffee on the only paper backup, a forgotten passphrase.

The discipline that ties all of this together is building a personal threat model before you touch a single tool. A threat model answers three questions: who would realistically target you (a random phishing bot casting a wide net, or someone who knows you hold significant funds), what they would want (your full balance, a one-time transfer, your identity for further attacks), and how much friction they're willing to tolerate (mass phishing campaigns fail against basic hygiene; a targeted attacker with your home address requires physical security, not just better software). Most people over-index on exotic threats (nation-state attacks, zero-day exploits) and under-index on the boring ones that actually cause losses: reusing a password, trusting a DM from "support," or storing a seed phrase as a photo in a cloud-synced camera roll.

It helps to separate threats by actor type, because the right defense differs for each. Opportunistic attackers (phishing kits, scam bots, drainer contracts) attack anyone who clicks — defense here is mostly hygiene: verifying URLs, never connecting a wallet to an unfamiliar site, never pasting a seed phrase anywhere. Targeted attackers (someone who has identified you specifically as holding significant funds, often through public on-chain activity, social media, or a data leak) require operational security: reducing your public footprint, separating identity from holdings, and hardening physical security. Insider or supply-chain threats (a compromised device, a tampered hardware wallet bought from a reseller, malicious browser extensions) require verification habits: buying directly from manufacturers, checking tamper-evident packaging, and verifying firmware signatures. Finally, your own process is itself a threat actor — most crypto losses are not attacks at all, but self-inflicted: a seed phrase stored in one place with no backup, a typo in an address with no verification step, or a transaction signed in a hurry without reading what it actually authorizes.

Worked example

Compare two real failure modes side by side. In the Mt. Gox collapse, users did everything "right" individually — strong passwords, 2FA — and still lost funds, because the failure was structural: the exchange itself was insolvent and mismanaged, and no amount of personal security hygiene protects against counterparty risk. Contrast that with a self-custody loss: a user generates a seed phrase correctly, but stores it as a single paper copy in a desk drawer; a flood destroys the drawer, and the funds are unrecoverable. Same asset class, completely different cause. The first requires a custody decision (don't leave large balances on exchanges); the second requires an operational decision (redundant, durable backups). Neither victim was reckless by common standards, but neither had mapped the actual threat before it happened.

A third, more targeted example: a holder posts publicly about a large NFT sale, tagging their wallet address. Weeks later, they receive a highly personalized phishing message referencing the exact sale and amount, impersonating a well-known hardware wallet brand's "security team," asking them to "revalidate" their wallet through a link. Because the message is specific and well-timed, it bypasses the skepticism that a generic phishing email would trigger. This illustrates why reducing your public footprint (not broadcasting holdings tied to identifiable wallets) is itself a threat-model decision, not just a privacy preference.

Exercise

Write a one-paragraph threat model for your own holdings. Answer directly:

1. What is my single biggest realistic risk right now — not the scariest hypothetical, but the one most likely to actually occur given how I currently store and access funds?
2. Who or what causes that risk (an exchange, my own backup process, a public wallet address, a shared device)?
3. What is the one control that would most reduce it, even if it isn't a complete fix (moving funds to self-custody, adding a second backup location, enabling hardware 2FA, reducing public linkage between your identity and your wallet)?
4. Which actor type (opportunistic, targeted, supply-chain, or your own process) is most responsible for that risk, and does your current defense actually match that actor type?

Keep this paragraph — every later module (custody architecture, multisig design, backup redundancy, inheritance planning) builds directly on the threat model you write here, so be honest rather than aspirational.

Recap

• Custodial risk (trusting a third party) and operational risk (trusting your own process) are different failure modes requiring different fixes.
• Threats come from distinct actor types — opportunistic, targeted, supply-chain, and your own process — each requiring a different defense, not one generic fix.
• Most real losses come from boring, un-dramatic causes — reused credentials, single points of failure, social engineering — not exotic attacks.
• A written, honest threat model (who, what, how much friction) is the foundation every later custody decision in this course depends on.

Resources

• Mt. Gox collapse — the classic custodial-risk case study referenced in this lesson
• Collapse of FTX — a second, more recent custodial-risk case study
• Chainalysis Crypto Crime Report — annual data on attacker tactics and losses
• xkcd: Security — the classic "$5 wrench attack" reference for physical-coercion threat modeling