MetaMask's decade-long effort to protect wallet users from fraud and theft reached a major milestone in July 2026, revealing that the platform blocked 6.5 million malicious website visits in 2025 alone, preventing nearly 150,000 malicious transactions and helping users avoid over $500 million in losses. The milestone comes as global law enforcement agencies intensify operations against crypto crime infrastructure, while security researchers report that attacks are becoming fewer in number but far more targeted and sophisticated.

What Are the Biggest On-Chain Security Threats Right Now?

The first half of 2026 saw a significant shift in how hackers operate. Security firms SlowMist and TRM Labs independently tracked crypto security incidents and found that while the total number of attacks declined compared to the same period in 2025, the dollar losses remained substantial. SlowMist counted 182 security incidents totaling roughly $956 million in losses, while TRM Labs identified 207 incidents totaling about $972 million. The difference in incident counts reflects how each firm classifies what constitutes a reportable hack, but both agree on the broader trend: attackers are becoming more selective and surgical in their targets.

The nature of these attacks has also shifted dramatically. Rather than exploiting basic smart contract vulnerabilities, sophisticated actors are now targeting operational weaknesses and supply chain gaps. The Kelp DAO exploit on LayerZero, which resulted in a $292 million loss from a compromised configuration, exemplifies this trend. TRM Labs attributes $643 million, or 66 percent, of all H1 2026 losses to North Korea-linked actors, suggesting that state-sponsored groups are increasingly involved in high-value cryptocurrency theft.

How Are Law Enforcement and Security Teams Fighting Back?

Global law enforcement agencies are taking coordinated action against the infrastructure that enables crypto crime. INTERPOL's Operation First Light, which spanned 97 countries, resulted in nearly 5,800 arrests and $293 million in intercepted assets tied to social engineering scams. The operation dismantled a fake police station in Eswatini, traced a $122.5 million crypto laundering trail in Thailand, and blocked a $6.6 million business email compromise transfer between Singapore and Oman in real time.

Europol's Operation Endgame took down malware pipelines that had been stealing cryptocurrency and wallet credentials from victims. The operation froze approximately $47 million in criminal crypto by dismantling the infrastructure behind three major malware families: SocGholish, Amadey, and StealC. Researchers at Proofpoint discovered that StealC included a control panel with a plugin specifically designed to decrypt the seed phrases of MetaMask wallets, revealing how targeted these attacks had become. Police recovered 27 million stolen credentials and took down 326 servers and 142 domains.

In Poland, a joint effort between Polish police, the FBI, and Homeland Security Investigations arrested four suspects accused of conducting SIM-swapping attacks, a technique where hackers hijack phone numbers and email accounts to take over cryptocurrency exchange logins. Independent blockchain investigator ZachXBT assisted in identifying one suspect from raid photos, demonstrating how public-private collaboration is becoming essential to combating crypto crime.

Steps to Strengthen Your On-Chain Security Awareness

• Recognize Social Engineering Tactics: INTERPOL's Operation First Light highlighted how scammers use fake police stations, business email compromise, and social engineering to trick victims into sending cryptocurrency. Awareness of these tactics is the first line of defense against becoming a target.
• Protect Your Seed Phrase and Private Keys: The discovery that malware like StealC specifically targets MetaMask seed phrase decryption underscores the critical importance of keeping recovery phrases offline and never entering them into websites or applications you do not fully trust.
• Monitor for Suspicious Wallet Activity: Use built-in security alerts and real-time threat monitoring features offered by modern wallet platforms to detect unauthorized access attempts or unusual transaction patterns before funds are stolen.
• Verify Software Authenticity: Malware families like SocGholish trick victims through fake browser updates. Always download wallet software and security updates directly from official sources, not from links in emails or pop-up notifications.
• Enable Multi-Factor Authentication: SIM-swapping attacks succeed when email and phone accounts lack robust authentication. Use authenticator apps rather than SMS-based two-factor authentication whenever possible.

MetaMask's security infrastructure includes built-in security alerts, frontrun protection, real-time threat monitoring, and regular independent security audits. These layers work together to protect users at multiple stages of their on-chain journey, from transaction initiation through settlement.

Why Is the Security Community Struggling to Stay Funded?

Despite the critical importance of on-chain security research, funding remains a persistent challenge for the teams doing the work. The Red Guild, a collective of active contributors to the Web3 security space for over three years, came in second place in Giveth's Ethereum Security Quantum Funding round but found that even this support was insufficient to sustain operations as a public good. The organization has been exploring alternative revenue models, including potential commercialization of tools like The Phishing Dojo, a threat simulation program designed to improve security awareness across the ecosystem.

"We will continue exploring different ways to fund ourselves, but this time outside public-good contributions, at least temporarily, until we can find our holy grail," stated matta, one of The Red Guild's founders.

matta, Founder, The Red Guild

The Red Guild's past contributions to Ethereum security include leading the ETH Rangers program, running security awareness campaigns, developing Damn Vulnerable DeFi as an educational resource, and leading the Security Frameworks initiative alongside SEAL. The struggle to fund this work highlights a broader challenge in the crypto ecosystem: critical security infrastructure often relies on volunteer effort or underfunded grants, creating sustainability risks for the teams that protect the entire industry.

As MetaMask enters its second decade, the platform's commitment to security reflects a broader industry shift toward treating protection as a core feature rather than an afterthought. The combination of technical controls, law enforcement coordination, and community education suggests that on-chain security is maturing from a reactive response to breaches into a proactive, layered defense strategy. However, the funding challenges facing security researchers and the increasing sophistication of attacks indicate that this work will require sustained investment and collaboration across the entire ecosystem.