By Max Courchesne-Mackie, Security Architect at Figment, BSSC member
Blockchain technology has fundamentally changed how digital systems establish trust. Instead of relying on a central authority, distributed ledgers allow participants to verify transactions collectively. That shift has created new opportunities — and new security challenges.
Yet one misconception continues to surface across the industry: that Web3 security is fundamentally different from traditional cybersecurity.
It isn't.
The computers are still computers. The servers still run operating systems. Applications still contain software bugs. Developers still make mistakes. And people are still susceptible to phishing emails, compromised credentials, and social engineering.
What has changed is that blockchain systems introduce an additional layer of technology that requires specialized security controls. Organizations building or operating Web3 systems need to protect both layers simultaneously: the mature security practices developed over decades of traditional software engineering and the blockchain-specific controls unique to decentralized systems.
The strongest security programs recognize that these are complementary — not competing — disciplines.
The foundation remains the same as it has always been.
Smart contracts — the software programs that execute transactions automatically on a blockchain — should be developed using a secure software development lifecycle (SDLC). That includes practices such as peer code reviews, static and dynamic application security testing (SAST and DAST), and secure continuous integration and deployment (CI/CD) pipelines that help identify vulnerabilities before software reaches production.
The supporting infrastructure deserves equal attention.
Blockchain nodes, which maintain copies of the distributed ledger and participate in transaction processing, are ultimately servers. Remote Procedure Call (RPC) endpoints — the interfaces applications use to communicate with blockchain networks — also require careful administration. Like any production infrastructure, they need strong access controls, least-privilege permissions, timely patching, logging, monitoring, and ongoing maintenance.
Then there is the human element.
Multi-factor authentication, endpoint protection, credential management, employee offboarding, and phishing-resistant authentication remain among the most effective ways to reduce organizational risk. While these controls may seem ordinary, attackers continue to exploit weaknesses in them because they often provide easier access than attempting to compromise blockchain protocols themselves.
Traditional cybersecurity, however, addresses only part of the challenge.
Blockchain introduces entirely new responsibilities that have few direct equivalents in conventional enterprise IT.
Private cryptographic keys — the digital credentials that authorize blockchain transactions — must be generated, stored, rotated, and retired securely throughout their lifecycle. Smart contracts require specialized assurance because, once deployed, they are often difficult or impossible to modify. Organizations also need consistent approaches for operating blockchain nodes, integrating digital assets into existing systems, and managing decentralized infrastructure.
These aren't simply extensions of existing security programs. They require standards designed specifically for blockchain environments.
That is one reason the Blockchain Security Standards Council (BSSC) was established. As a nonprofit consortium, the Council develops security standards and companion audit frameworks that help organizations build secure blockchain ecosystems from end to end. Rather than replacing established cybersecurity guidance, the Council's baseline standards map directly to the NIST Cybersecurity Framework, allowing organizations to extend familiar security practices into Web3 while addressing the industry's unique technical requirements.
The goal is not to reinvent cybersecurity. It is to fill the gaps that traditional frameworks were never intended to address.
Recent events demonstrate why both layers matter.
The 2025 Bybit theft — the largest cryptocurrency theft publicly reported to date — was not the result of a flaw in blockchain consensus or a vulnerability in a smart contract. Investigators concluded that malicious code originating within Safe{Wallet}'s infrastructure compromised the user interface used to authorize transactions. The underlying smart contracts remained secure.
According to public investigations, the attack originated from a compromised developer workstation that enabled malicious JavaScript to be introduced into the signing interface presented to a small group of targeted users. From the users' perspective, everything appeared legitimate while the software silently altered what they were approving.
The blockchain performed exactly as designed.
The surrounding environment did not.
The lesson extends well beyond a single incident. Security failures frequently emerge where systems intersect with people, software supply chains, development environments, infrastructure, and operational processes. These "edge" components are often outside the blockchain itself but remain essential to its secure operation.
Protecting only the blockchain is therefore insufficient. Organizations must protect the entire ecosystem surrounding it.
The blockchain industry has reached an important point in its evolution.
Early adopters often had to develop security practices independently because few common standards existed. Today, organizations no longer have to invent these approaches from scratch. Industry-developed standards and audit frameworks are beginning to provide a shared foundation for secure blockchain operations while remaining compatible with established cybersecurity practices.
This is particularly important because blockchain adoption continues to accelerate across financial services, digital identity, supply chains, and other critical infrastructure sectors. As these systems mature, consistency becomes just as important as innovation.
Security should enable adoption, not slow it.
Organizations can continue moving quickly while building confidence that fundamental controls are consistently applied — from developer workstations and production infrastructure to key management, node operations, and smart contract assurance.
Web3 doesn't replace the security principles we've relied on for decades.
It builds upon them.
The strongest blockchain security programs will continue to pair proven cybersecurity fundamentals with purpose-built standards that address the unique characteristics of decentralized technologies. Together, they provide the end-to-end approach needed to strengthen trust across the entire blockchain ecosystem.
1. BSSC Standards — General Security and Privacy Guidelines, mapped to the NIST Cybersecurity Framework. https://specs.blockchainssc.org/
2. BSSC Publishes First Four Security Standards — including the Node Operation Standard (NOS), BusinessWire, May 13, 2025. https://www.businesswire.com/news/home/20250513728554/en/Blockchain-Security-Standards-Council-Publishes-First-Four-Security-Standards
3. "Hack of wallet provider is behind $1.4bn Bybit theft, investigation finds," DL News (Sygnia investigation: root cause was malicious code from Safe Wallet infrastructure; no smart contract or source code vulnerabilities). https://www.dlnews.com/articles/defi/safe-wallet-compromise-behind-bybit-hack/
4. "Bybit Hack Traced to Safe{Wallet} Supply Chain Attack," The Hacker News, Feb 27, 2025 (Safe{Wallet}: attack via a compromised developer machine). https://thehackernews.com/2025/02/bybit-hack-traced-to-safewallet-supply.html
5. "Bybit Hack: In-Depth Technical Analysis," NCC Group, Mar 10, 2025 (malicious JavaScript injected into Safe{Wallet} UI, selectively targeting Bybit signers). https://www.nccgroup.com/research/in-depth-technical-analysis-of-the-bybit-hack/
6. "Back to Building: Ronin Security Breach Postmortem," Ronin blog (spear-phishing of an employee; five of nine validator keys compromised; stale allowlist). https://roninchain.com/blog/posts/back-to-building-ronin-security-breach-6513cc78a5edc1001b03c364
