Weekly Crypto Web3 Safety Digest CW13 2026
Curated Threat Intelligence for Real-World Web3 Risks
This Weekly Crypto and Web3 Safety Digest for CW13 2026 analyzes real-world loss incidents across scams, hacks, and user mistakes observed during the week.
The report is built from a curated dataset of confirmed incidents, derived from public disclosures, social monitoring, and security reporting. It reflects how losses occur in practice rather than theoretical attack models.
CW13 contains 33 confirmed incidents across the dataset. Scam-classified incidents represent the largest category, while hack-classified incidents and user-originated losses appear at lower but equal levels.
Within scam-classified activity, phishing and investment_scam appear as the most frequent subtypes. Additional activity is present across exchange_scam and social_engineering mechanisms.
Hack-classified incidents appear across malware, keylogger, and clipboard_hijacker compromise vectors.
User-originated losses are led by wrong_network, with additional incidents across seed_phrase_exposure and lost_wallet_access.
Primary artifacts (CW13)
Weekly incident dataset (incidents.csv):
https://github.com/cryptosafetyfirst/csf-crypto-incident-database/tree/main/incidents/2026/2026-13
Weekly intelligence artifacts (taxonomies, prevention mappings, notes):
https://github.com/cryptosafetyfirst/csf-crypto-incident-database/tree/main/weeks/2026/CW13
These links provide direct access to the canonical dataset and analytical outputs referenced throughout this report.
Collection & Curation Scope (CW13)
Each weekly digest reflects a curated intelligence subset derived from review of raw reports, disclosures, and signals observed across public forums, social platforms, incident disclosures, and security reporting during the week.
Only incidents meeting classification, verifiability, and analytical relevance thresholds are normalized into the CW13 dataset. The counts presented in this report represent confirmed cases rather than total observed scam attempts or low-signal activity.
CW13 confirms structural continuity with redistribution across categories:
– total incidents: 33
– scams: 21
– hacks: 6
– user_mistakes: 6
CW13 reflects distribution across established incident_type categories without introduction of new classification types.
Executive Layer — CW13 at a Glance
Derivation declaration (CW13):
– incidents.csv (CW13)
– taxonomy_report (CW13)
– prevention_report (CW13)
– governance_notes.md (CW13)
CW13 contains 33 confirmed incidents across the dataset. Distribution across incident types is as follows:
– scams: 21
– hacks: 6
– user_mistakes: 6
Scam-classified incidents represent the largest category in CW13 based on absolute count.
Relative to CW12 (43 total incidents: 32 scams, 3 hacks, 8 user_mistakes), CW13 reflects a reduction in total volume alongside redistribution across incident types:
– scam incidents decrease from 32 to 21
– hack incidents increase from 3 to 6
– user_mistake incidents decrease from 8 to 6
No new incident_type categories are present in CW13.
Key Judgments — CW13
– Scam-classified incidents represent the largest category in CW13, with 21 of 33 total incidents.
– phishing and investment_scam appear as the most frequent scam subtypes in the CW13 dataset.
– exchange_scam and social_engineering are also present within scam-classified incidents.
– Hack-classified incidents total 6 and appear across malware, keylogger, and clipboard_hijacker subtypes.
– User-originated incidents total 6 and include wrong_network, seed_phrase_exposure, and lost_wallet_access.
– No new incident_type categories are introduced in CW13.
CW13 in 3 numbers (taxonomy_report, CW13):
– scams: 21
– hacks: 6
– user mistakes: 6
Longitudinal note
CW13 shows a reduction in total incident count relative to CW12, alongside redistribution across incident types.
– Scam-classified incidents decrease in absolute count but remain the largest category.
– Hack-classified incidents increase in count relative to CW12.
– User-originated incidents decrease in count relative to CW12.
This change reflects variation in distribution within established categories rather than introduction of new classification types.
Positioning note (series continuity)
This weekly series tracks scam-classified incidents, hack-classified incidents, and user-originated losses using a consistent taxonomy and prevention mapping framework.
Canonical authority remains:
– incidents.csv
– taxonomy_report
– prevention_report
– manifest.md
These artifacts enable comparability across weeks without altering classification structure.
Top CW13 prevention levers (prevention_report, CW13 — normalized coverage only):
– verify platform legitimacy before use
– avoid unsolicited messages calls and DMs
– do not pay fees to unlock withdrawals
These actions are explicitly present in prevention_report (CW13).
Notable structural signals in CW13:
– no new incident_type categories appear
– scam-classified incidents remain the largest category by count
– hack-classified incidents increase in count relative to CW12
– user-originated incidents decrease in count relative to CW12
– governance_notes.md (CW13) indicates no taxonomy scope change or reclassification
Golden Rule governance signal (CW13):
Golden Rule testing was executed against the CW13 dataset.
No new rule creation thresholds were triggered and no rule logic modifications were required.
Defensive Baseline — Tools Referenced in This Digest
This weekly digest analyzes loss mechanisms observed in CW13.
The defensive tools referenced throughout this report are maintained here:
→ tools to reduce exposure to scams and wallet drains
That page consolidates the core tools used to reduce exposure to:
– fake platforms and pay-to-withdraw schemes
– phishing, impersonation, and account takeover
– wallet drainers, malicious tools, and endpoint compromise
– irreversible user-originated errors
CW13 defensive sufficiency was assessed via defensive_coverage_gap_report.md (CW13). The audit determined:
All dominant earliest preventable failure points evaluated in CW13 were assessed as covered or partially covered within the CSF Defensive Canon. None were assessed as uncovered.
For recurring interpretive questions, see the evergreen reference:
→ recurring recovery and scam questions
The public FAQ remains an evergreen downstream reference. CW13 alignment was evaluated via faq_signal_report.md (CW13), which assessed reinforcement, absence, or candidate adjustments strictly against CW13 evidence.
These governance artifacts:
– do not create intelligence
– do not modify taxonomy or prevention mappings
– do not influence weekly synthesis or conclusions
Weekly Synthesis — CW13 Loss Dynamics
Derivation declaration (CW13):
– incidents.csv (CW13)
– taxonomy_report (CW13)
– prevention_report (CW13)
– governance_notes.md (CW13)
CW13 contains 33 curated incidents.
Structural Signal — CW13
Relative to CW12 (43 incidents: 32 scams, 3 hacks, 8 user_mistakes), CW13 reflects a reduction in total incident count alongside redistribution across incident types:
– scam incidents decrease from 32 to 21
– hack incidents increase from 3 to 6
– user_mistake incidents decrease from 8 to 6
No new incident_type categories are present in CW13.
Threat Pressure Gauge — CW13
– scam pressure: highest by count (21 of 33 incidents)
– hack pressure: increased in count relative to CW12 (from 3 to 6)
– user_mistake pressure: present at 6 incidents
Incident type distribution (taxonomy_report, CW13)
– scam: 21
– hack: 6
– user_mistake: 6
Scam-classified incidents represent the largest category by count in CW13.
No new incident_type categories appear in CW13.
Scam-Classified Activity — CW13
Within scam-classified incidents, the following subtypes are present in taxonomy_report (CW13):
– phishing
– investment_scam
– exchange_scam
– social_engineering
– token_launch_scam
– airdrop_scam
– romance_scam
– crypto_wallet_scam
– smart_contract_scam
– social_media_scam
– nft_scam
– rug_pull
– address_poisoning_copy_paste
phishing and investment_scam appear as the most frequent scam subtypes in the CW13 dataset based on counts in the Data Snapshot.
Hack-Classified Activity — CW13
Hack-classified incidents total 6 in CW13.
Subtypes present in taxonomy_report (CW13):
– malware
– keylogger
– clipboard_hijacker
– address_poisoning_copy_paste
– crypto_wallet_scam
– smart_contract_scam
These incidents reflect compromise occurring through credential capture, input manipulation, or interaction within untrusted environments as observed in incidents.csv (CW13).
No incident in CW13 indicates consensus-level or cryptographic failure.
User-Originated Activity — CW13
User-originated incidents total 6 in CW13.
Subtypes present in taxonomy_report (CW13):
– wrong_network
– seed_phrase_exposure
– lost_wallet_access
These incidents occur without direct adversarial interaction and result from execution or operational decisions recorded in incidents.csv (CW13).
Observed Failure Points — CW13
Across CW13 incidents, the following failure points are observable in incidents.csv:
– trust placed in platforms or interfaces without independent verification
– continued interaction within unsolicited or externally initiated communication channels
– submission of credentials or approvals within unverified contexts
– transfer execution without verifying address or network compatibility
– absence of recovery readiness or recordkeeping at the time of activity
These observations are derived from incident-level behavior and align with prevention mapping in CW13.
Prevention Mapping Signal
prevention_report (CW13) shows strongest normalization around:
– verify platform legitimacy before use
– avoid unsolicited messages calls and DMs
– do not pay fees to unlock withdrawals
These actions correspond to early-stage decisions observed in CW13 incidents.
Governance Signal — CW13
governance_notes.md (CW13) indicates:
– no new incident_type categories
– no taxonomy scope changes
– no reclassification events
Observed variation in CW13 reflects redistribution across existing categories.
Synthesis — CW13
Across CW13 incidents, loss outcomes occur following actions that grant:
– platform trust
– execution authority
– credential or secret access
Once these actions occur, subsequent transaction execution follows standard protocol behavior.
CW13 therefore reflects that loss outcomes align with decisions made prior to transaction execution rather than failures of blockchain enforcement.
CW13 Data Snapshot — Evidence Anchors
The tables below ground the CW13 analysis directly in canonical weekly artifacts. Counts are taken from taxonomy_report (CW13) and prevention_report (CW13).
CW13 Incident Classification Overview
Total incidents in CW13 dataset: 33 (taxonomy_report, CW13)
Incident type | Count (CW13) | Primary source |
Scam | 21 | taxonomy_report (CW13) |
Hack | 6 | taxonomy_report (CW13) |
User mistake | 6 | taxonomy_report (CW13) |
CW13 Scam Mechanisms Present (Top recurring subcategories)
Scam Mechanism (Subcategory) | Count (CW13) | Primary Source |
phishing | 6 | taxonomy_report (CW13) |
investment_scam | 6 | taxonomy_report (CW13) |
exchange_scam | 4 | taxonomy_report (CW13) |
social_engineering | 4 | taxonomy_report (CW13) |
token_launch_scam | 2 | taxonomy_report (CW13) |
airdrop_scam | 2 | taxonomy_report (CW13) |
romance_scam | 2 | taxonomy_report (CW13) |
crypto_wallet_scam | 2 | taxonomy_report (CW13) |
address_poisoning_copy_paste | 1 | taxonomy_report (CW13) |
smart_contract_scam | 1 | taxonomy_report (CW13) |
social_media_scam | 1 | taxonomy_report (CW13) |
rug_pull | 1 | taxonomy_report (CW13) |
nft_scam | 1 | taxonomy_report (CW13) |
CW13 Hack Mechanisms Present
Hack Mechanism (Subcategory) | Count (CW13) | Primary Source |
malware | 1 | taxonomy_report (CW13) |
keylogger | 1 | taxonomy_report (CW13) |
clipboard_hijacker | 1 | taxonomy_report (CW13) |
address_poisoning_copy_paste | 1 | taxonomy_report (CW13) |
crypto_wallet_scam | 1 | taxonomy_report (CW13) |
smart_contract_scam | 1 | taxonomy_report (CW13) |
CW13 User-Originated Loss Patterns Present
Subtype | Count (CW13) | Primary source |
wrong_network | 4 | taxonomy_report (CW13) |
seed_phrase_exposure | 1 | taxonomy_report (CW13) |
lost_wallet_access | 1 | taxonomy_report (CW13) |
CW13 Prevention Coverage (Most-cited prevention actions)
Prevention action | Primary source |
Verify platform legitimacy before use | prevention_report (CW13) |
Avoid unsolicited messages calls and DMs | prevention_report (CW13) |
Do not pay fees to unlock withdrawals | prevention_report (CW13) |
Enable strong authentication and account security | prevention_report (CW13) |
Incident Mix — By Category and Impact
Derivation declaration (CW13):
– incidents.csv (CW13)
– taxonomy_report (CW13)
– prevention_report (CW13)
– governance_notes.md (CW13)
The CW13 incident set spans multiple loss categories. Scam-classified incidents represent the largest category by count in CW13. Relative to CW12, scam incidents decrease from 32 to 21, hack incidents increase from 3 to 6, and user_mistake incidents decrease from 8 to 6. No new incident_type categories appear in CW13.
CW13 incidents continue to show losses occurring across attacker-controlled platforms, externally initiated communication channels, credential or approval exposure, and irreversible user-originated execution errors. This reflects redistribution within established categories rather than introduction of new classification types.
Scams — Recurrent Execution Patterns
Scam-classified incidents total 21 in CW13. Subtypes present in taxonomy_report (CW13) include:
– phishing
– investment_scam
– exchange_scam
– social_engineering
– token_launch_scam
– airdrop_scam
– romance_scam
– crypto_wallet_scam
– smart_contract_scam
– social_media_scam
– nft_scam
– rug_pull
– address_poisoning_copy_paste
Within CW13 scam activity, phishing and investment_scam appear at the highest counts. exchange_scam and social_engineering are also present.
Observed scam-classified behaviors in incidents.csv (CW13) include:
– redirection into attacker-controlled platforms or interfaces
– communication initiated through unsolicited or externally controlled channels
– deposits made into environments where withdrawal or access later became restricted
– trust placed in dashboards, token offers, wallet interactions, or relationship-driven narratives without independent verification
Prevention alignment in prevention_report (CW13) includes:
– verify platform legitimacy before use
– avoid unsolicited messages calls and DMs
– do not pay fees to unlock withdrawals
Hack-Classified Incidents — Observed Compromise Patterns
Hack-classified incidents total 6 in CW13. Subtypes present in taxonomy_report (CW13) include:
– malware
– keylogger
– clipboard_hijacker
– address_poisoning_copy_paste
– crypto_wallet_scam
– smart_contract_scam
Observed hack-classified behaviors in incidents.csv (CW13) include:
– malware present in the interaction environment
– credential or input capture through keylogger activity
– altered transfer destination data through clipboard_hijacker activity
– asset loss following interaction with compromised or untrusted contexts
No CW13 incident indicates consensus-level or cryptographic failure.
Prevention alignment in prevention_report (CW13) includes:
– enable strong authentication and account security
User Errors & Operational Failures — Non-Adversarial Losses
User_mistake incidents total 6 in CW13. Subtypes present in taxonomy_report (CW13) include:
– wrong_network
– seed_phrase_exposure
– lost_wallet_access
Observed user-originated behaviors in incidents.csv (CW13) include:
– transfers executed on an incompatible or unsupported network
– exposure of seed material
– loss of wallet access due to failed recovery readiness
These incidents occur without direct attacker involvement in the classification record and result in irreversible or difficult-to-recover outcomes.
CW13 Incident Mix — Qualitative Evidence Mapping
Category | Evidence in CW13 corpus | Primary source |
scam | phishing; investment_scam; exchange_scam; social_engineering; token_launch_scam; airdrop_scam; romance_scam; crypto_wallet_scam; smart_contract_scam; social_media_scam; nft_scam; rug_pull; address_poisoning_copy_paste | incidents.csv (CW13); taxonomy_report (CW13) |
hack | malware; keylogger; clipboard_hijacker; address_poisoning_copy_paste; crypto_wallet_scam; smart_contract_scam | incidents.csv (CW13); taxonomy_report (CW13) |
user_mistake | wrong_network; seed_phrase_exposure; lost_wallet_access | incidents.csv (CW13); taxonomy_report (CW13) |
prevention mapping | verify platform legitimacy before use; avoid unsolicited messages calls and DMs; do not pay fees to unlock withdrawals; enable strong authentication and account security | prevention_report (CW13) |
governance signals | no scope change; no reclassification events; stable taxonomy structure | governance_notes.md (CW13) |
This mapping anchors the section directly to CW13 canonical inputs and does not introduce categories, mechanisms, or interpretations outside the weekly artifact set.
Structural Note — Why These Sections Repeat Each Week
The sections that follow examine recurring loss categories observed in the weekly dataset, as defined in taxonomy_report (CW13).
These categories include:
– scam-classified incidents
– hack-classified incidents
– user_mistake incidents
Each category contains subtypes defined within the taxonomy structure, which may appear in varying combinations across weekly datasets.
Because the taxonomy structure remains unchanged in CW13, these sections appear in each report using the same category framework.
What varies week to week is:
– the number of incidents within each category
– the distribution of subtypes inside each category
CW13 reflects changes in distribution across scam, hack, and user_mistake incidents without introducing new incident_type categories.
1. Fake Platforms & Scam Execution Environments
Derivation declaration (CW13):
– incidents.csv (CW13)
– taxonomy_report (CW13)
– prevention_report (CW13)
CW13 contains 21 scam-classified incidents. Relative to CW12, scam-classified incidents decrease from 32 to 21, while remaining the largest category by count in CW13.
Within scam-classified activity, phishing and investment_scam each appear at 6 incidents. exchange_scam and social_engineering each appear at 4 incidents. Additional scam subtypes are present at lower counts within the CW13 dataset.
Observed scam-classified activity in incidents.csv (CW13) includes:
– phishing-led contact or redirection into attacker-controlled interfaces
– investment_scam narratives tied to deposits or account growth claims
– exchange_scam environments involving blocked access, restricted withdrawals, or additional payment demands
– social_engineering activity using trust, authority, or guided interaction to move victims toward deposits or approvals
– token_launch_scam, airdrop_scam, and social_media_scam activity tied to promoted opportunities or participation claims
– romance_scam cases where relationship-building preceded financial or platform engagement
– crypto_wallet_scam and smart_contract_scam cases involving wallet interaction or contract-linked participation
– nft_scam, rug_pull, and address_poisoning_copy_paste cases present at lower frequency
The scam-classified incidents in CW13 do not describe a single uniform sequence. However, multiple cases show a recurring pattern in which users engaged with externally presented opportunities, platforms, or interfaces and later encountered restricted access, withdrawal friction, or loss after trusting the presented environment.
Social Engineering Entry Activity
phishing, investment_scam, and social_engineering together account for a substantial share of scam-classified activity in CW13.
Observed entry behavior in incidents.csv (CW13) includes:
– unsolicited messages or externally initiated contact
– guided movement into controlled interfaces or opportunity narratives
– authority or relationship framing before deposit, login, or wallet interaction
– token or platform access claims used to establish perceived legitimacy
These behaviors are directly consistent with prevention_report (CW13), which includes:
– verify platform legitimacy before use
– avoid unsolicited messages calls and DMs
Withdrawal Restriction and Additional Payment Demands
exchange_scam and parts of investment_scam activity in CW13 include cases where access to funds or withdrawals was reported as conditional, delayed, or tied to additional payment demands.
Observed behavior in incidents.csv (CW13) includes:
– balances or profits displayed before access problems emerged
– additional fees, compliance steps, or release conditions introduced after deposit
– continued restriction after prior engagement or payment
– visible balances reported as inaccessible
These observations support the presence of withdrawal-friction behavior in CW13 scam incidents, but the exact sequence is not identical across all cases.
prevention_report (CW13) includes:
– do not pay fees to unlock withdrawals
Platform Legitimacy and Interface Trust
Several CW13 scam-classified incidents involve trust placed in:
– dashboards or account balances
– exchange-like or platform-like interfaces
– token or participation pages
– support-style communication inside the same environment
In these cases, the reported loss mechanism depends on acceptance of the presented environment as legitimate before independent verification occurred.
This is consistent with prevention_report (CW13), which includes:
– verify platform legitimacy before use
Smart Contract, Wallet, Token, and Promotion-Linked Scams
CW13 includes scam-classified incidents across:
– crypto_wallet_scam
– smart_contract_scam
– token_launch_scam
– airdrop_scam
– social_media_scam
Observed behavior in incidents.csv (CW13) includes:
– participation offers tied to tokens or launches
– wallet interaction requests
– contract-linked access or reward claims
– promotion-driven discovery through public or social channels
These cases differ in presentation, but they share reliance on trust in the offering, interface, or participation mechanism.
Romance-Linked Scam Activity
romance_scam is present in CW13 at 2 incidents.
Observed behavior includes:
– relationship-building before financial discussion
– later introduction of platform, investment, or transfer activity
– movement from personal trust into financial engagement
These incidents remain scam-classified and are part of the broader trust-based loss environment visible in CW13.
Prevention Mapping — Earliest Preventable Failure Points (CW13)
Across scam-classified incidents in CW13, prevention_report (CW13) shows strongest normalization around:
– verify platform legitimacy before use
– avoid unsolicited messages calls and DMs
– do not pay fees to unlock withdrawals
These actions align with early-stage decisions observed across phishing, investment_scam, exchange_scam, and social_engineering activity in the CW13 corpus.
2. Phishing & Social Engineering
Derivation declaration (CW13):
– incidents.csv (CW13)
– taxonomy_report (CW13)
– prevention_report (CW13)
CW13 contains 21 scam-classified incidents. Within this category, phishing (6) and social_engineering (4) are present at material counts in CW13. These subtypes appear as primary interaction channels through which users are first engaged before subsequent actions such as deposits, credential entry, or wallet interaction.
This section examines phishing and social_engineering behavior observable in CW13 incidents without assuming uniform downstream outcomes.
Entry Through Controlled Communication Channels
Observed CW13 initiation behavior includes:
– phishing messages directing users to login pages, dashboards, or platform interfaces
– unsolicited outreach via messaging platforms or social media
– communication framed as investment opportunity, platform access, or account-related interaction
– escalation from public posts or promotions into direct message interaction
In these cases, interaction begins through externally initiated contact rather than user-driven navigation.
prevention_report (CW13) includes:
– avoid unsolicited messages calls and DMs
Redirection Into External Interfaces
CW13 phishing and social_engineering incidents include:
– links directing users to externally controlled websites or interfaces
– prompts to log in, verify accounts, or access opportunities
– movement from communication channel into platform-like environments
These interactions involve user navigation into environments that are not independently verified prior to engagement.
prevention_report (CW13) includes:
– verify platform legitimacy before use
Credential Entry and Interaction Requests
Observed CW13 behaviors include:
– entry of login credentials into externally presented interfaces
– interaction with account or platform access flows presented through links
– submission of information framed as verification or onboarding
Not all incidents follow the same path, but credential entry or interaction within externally provided environments appears across multiple phishing and social_engineering cases.
Authority and Opportunity Framing
CW13 incidents include communication framed around:
– investment access or trading opportunities
– platform participation or account-related actions
– support-style or guidance-based interaction
These narratives appear in phishing and social_engineering contexts and are used to encourage continued engagement or action.
Prevention Mapping — Communication and Entry Controls (CW13)
Across phishing and social_engineering activity in CW13, prevention_report (CW13) includes:
– verify platform legitimacy before use
– avoid unsolicited messages calls and DMs
These actions correspond to the initial interaction stage observed in CW13 incidents, where users engage with external communication channels and are redirected into platform or account-related workflows.
3. Hack-Classified Incidents — Device, Input & Interaction Compromise
Derivation declaration (CW13):
-incidents.csv (CW13)
-taxonomy_report (CW13)
-prevention_report (CW13)
CW13 contains 6 hack-classified incidents. As reflected in taxonomy_report (CW13), activity spans malware (1), keylogger (1), clipboard_hijacker (1), address_poisoning_copy_paste (1), crypto_wallet_scam (1), and smart_contract_scam (1).
This section examines compromise behavior directly observable in CW13 hack-classified incidents without assuming a single execution path.
Device and Input-Level Compromise
CW13 includes malware, keylogger, and clipboard_hijacker incidents.
Observed behavior in incidents.csv (CW13) includes:
– malware present within user environments during interaction or transaction activity
– keylogging capturing credentials or sensitive inputs during login or access flows
– clipboard_hijacker altering copied wallet addresses prior to transaction submission
These incidents involve interference at the device or input level during user interaction.
prevention_report (CW13) includes:
– enable strong authentication and account security
Address Manipulation and Transaction Redirection
CW13 includes address_poisoning_copy_paste incidents classified under hack.
Observed behavior includes:
– copied addresses being replaced or influenced prior to transaction execution
– transfers sent to unintended destinations following address substitution
These cases involve transaction outcomes affected by altered address data at the moment of execution.
Wallet and Contract Interaction-Linked Compromise
CW13 includes crypto_wallet_scam and smart_contract_scam within hack-classified incidents.
Observed behavior in incidents.csv (CW13) includes:
– wallet interaction within externally presented environments
– contract interaction requests linked to participation or access
– asset movement following interaction or approval
These incidents involve interaction with wallets or contracts prior to asset movement, with compromise occurring through the interaction context rather than protocol failure.
Observed Characteristics Across Hack-Classified Incidents
Across CW13 hack-classified incidents:
– activity occurs within user-controlled environments or during interaction with external inputs
– credentials, addresses, or transaction parameters are affected during use
– transaction execution follows submitted inputs
No CW13 incident indicates consensus failure, cryptographic breakage, or systemic blockchain malfunction.
Prevention Mapping — Interaction and Environment Controls (CW13)
Across hack-classified incidents in CW13, prevention_report (CW13) includes:
– enable strong authentication and account security
This action aligns with observed compromise points involving credential capture, device interaction, and transaction execution within user environments.
4. User Mistakes — CW13
Derivation declaration (CW13):
– incidents.csv (CW13)
– taxonomy_report (CW13)
– prevention_report (CW13)
CW13 contains 6 user_mistake incidents. As reflected in taxonomy_report (CW13), these include:
– wrong_network (4)
– seed_phrase_exposure (1)
– lost_wallet_access (1)
No CW13 user_mistake incidents are recorded under approval_misunderstanding, tax_recordkeeping, or poor_wallet_backup_practice.
This section examines non-adversarial loss behavior directly observable in CW13 incidents without assuming uniform outcomes across all cases.
Network Errors and Transfer Outcomes
wrong_network is the most frequent user_mistake subtype in CW13.
Observed behavior in incidents.csv (CW13) includes:
– transfers submitted on unsupported or unintended blockchain networks
– assumptions of compatibility between sender and destination environments
– transactions completed to destinations where recovery depends on external support
These incidents occur at the moment of transaction submission, where execution proceeds according to the specified network and address.
Seed Phrase Exposure
CW13 includes seed_phrase_exposure incidents within user_mistake classification.
Observed behavior includes:
– exposure of recovery phrases during interaction or storage
– loss occurring after recovery material was no longer controlled
These incidents involve handling of recovery data rather than external compromise mechanisms.
Wallet Access Loss
CW13 includes lost_wallet_access incidents.
Observed behavior includes:
– inability to access wallets due to missing or inaccessible recovery material
– loss discovered during access attempts or recovery scenarios
These cases reflect outcomes where access could not be re-established at the time it was required.
Observed Characteristics Across User Mistakes
Across CW13 user_mistake incidents:
– outcomes follow completed user actions such as transfers, storage, or access attempts
– transactions or access conditions proceed according to submitted inputs or available credentials
– recovery depends on prior preparation, compatibility, or retained access material
These incidents occur without requiring additional external interaction once the action is completed.
Prevention Mapping — Operational Controls (CW13)
Across user_mistake incidents in CW13, prevention_report (CW13) includes:
– maintain complete transaction and tax records
This action is explicitly present in prevention_report (CW13).
CW13 Prevention Levers — What Would Have Stopped Most Losses
Derivation declaration (CW13):
– incidents.csv (CW13)
– taxonomy_report (CW13)
– prevention_report (CW13)
This section maps directly observable CW13 failure points to prevention actions explicitly present in prevention_report (CW13). It does not introduce new actions or extend the normalized action set.
Across CW13, prevention_report (CW13) explicitly includes:
– Verify platform legitimacy before use
– Avoid unsolicited messages calls and DMs
– Do not pay fees to unlock withdrawals
– Enable strong authentication and account security
– Maintain complete transaction and tax records
CW13 Early Failure → Prevention Lever Mapping
CW13 Failure Pattern | Observable Failure Point in CW13 | Prevention Lever (CW13) |
phishing and social_engineering entry | users engaged with unsolicited or externally initiated contact | Avoid unsolicited messages calls and DMs |
phishing, investment_scam, exchange_scam, social_engineering | users trusted externally presented platforms, dashboards, or opportunity environments | Verify platform legitimacy before use |
exchange_scam and investment_scam withdrawal restriction cases | additional payment demands were introduced after deposit or during attempted withdrawal | Do not pay fees to unlock withdrawals |
malware, keylogger, clipboard_hijacker | compromise occurred during credential use, device interaction, or transaction execution | Enable strong authentication and account security |
wrong_network and access-related user_mistake cases | reconstruction, verification, or account-history clarity became relevant after the event | Maintain complete transaction and tax records |
The mappings above are limited to prevention actions explicitly visible in prevention_report (CW13) and failure points directly observable in incidents.csv (CW13).
CW13 prevention mapping shows strongest normalized alignment with:
– Verify platform legitimacy before use
– Avoid unsolicited messages calls and DMs
– Do not pay fees to unlock withdrawals
Additional normalized prevention coverage in CW13 includes:
– Enable strong authentication and account security
The CW13 mapping indicates that observed loss pathways intersect most clearly with:
– trust in externally presented platforms or interfaces
– engagement inside unsolicited communication channels
– additional payment demands during withdrawal restriction
– compromise during credential or transaction activity
The prevention actions listed in this section are limited to the normalized CW13 action set and are included only where direct mapping is supportable from CW13 artifacts.
Conclusion
CW13 contains 33 curated incidents:
– scams: 21
– hacks: 6
– user_mistake: 6
Scam-classified incidents represent the largest category in the CW13 dataset. Hack-classified incidents and user_mistake incidents are equal in count and remain present across their respective subtypes.
Within scams, activity is concentrated around phishing and investment_scam, with additional presence across exchange_scam and social_engineering. Additional scam subtypes appear at lower frequency within the CW13 dataset.
Hack-classified incidents are distributed across malware, keylogger, clipboard_hijacker, address_poisoning_copy_paste, crypto_wallet_scam, and smart_contract_scam.
User_mistake incidents are concentrated in wrong_network, with additional presence in seed_phrase_exposure and lost_wallet_access.
No new incident_type categories appear in CW13. Observed activity remains within the existing taxonomy structure.
Across CW13, observed loss pathways include:
– interaction with externally presented platforms or interfaces (phishing, investment_scam, exchange_scam)
– engagement through unsolicited or externally initiated communication (phishing, social_engineering)
– compromise during device interaction or transaction execution (malware, keylogger, clipboard_hijacker)
– transaction or access outcomes following user actions (wrong_network, lost_wallet_access, seed_phrase_exposure)
Prevention mapping in CW13 includes:
– Verify platform legitimacy before use
– Avoid unsolicited messages calls and DMs
– Do not pay fees to unlock withdrawals
– Enable strong authentication and account security
These actions correspond to failure points observed across scam, hack, and user_mistake incidents in CW13.
CW13 reflects distribution of incidents across established categories and subtypes without introducing new classification structures.
For deeper defensive guidance:
Hacks & execution-environment security fundamentals:
https://cryptosafetyfirst.com/keep-your-crypto-safe-from-hackers/
Recognizing manufactured legitimacy in crypto platforms:
https://cryptosafetyfirst.com/crypto-web3-scam-prevention-guidebook/
Operational failures that lead to irreversible loss:
https://cryptosafetyfirst.com/crypto-web3-user-mistakes-prevention-guidebook/
Layered custody architecture:
Disclaimer — Read Before Acting on This Digest
This Weekly Crypto and Web3 Safety Digest CW13 2026 is based on curated open-source intelligence (OSINT), including public Reddit posts, social media reports, incident disclosures, and security reporting. While every effort is made to accurately summarize observed patterns and incidents, details such as loss amounts, timelines, and technical specifics may be incomplete, inaccurate, or later revised.
This digest is provided for educational and awareness purposes only. Nothing in this report constitutes financial, investment, legal, cybersecurity, or tax advice.
Methodology & AI Disclosure
This report is derived from the canonical weekly incident dataset and associated analytical artifacts for CW13.
Incidents are sourced from publicly available disclosures, community reporting, security research, and reputable media. Each record undergoes structured normalization, taxonomy classification, and prevention mapping prior to inclusion in the weekly dataset.
Only incidents that meet sourcing, consistency, and taxonomy validation thresholds are included in the published weekly corpus. Reports that are incomplete, unverifiable, duplicative, or represent unsuccessful attempts are excluded to preserve analytical integrity and longitudinal comparability.
Incident Volume Context
Weekly incident counts reflect curated, validated cases — not total observed scam outreach or attempted activity.
Each reporting period involves review of substantially more raw signals than are ultimately normalized into the dataset. Published counts represent confirmed and classified incidents only.
AI-Assisted Workflow Disclosure
Portions of the workflow use AI-assisted tooling to support:
– structuring and formatting normalized records
– summarizing verbose or technical source material
– drafting image descriptions
– improving structural consistency across sections
AI tools are used for workflow efficiency and formatting support only.
All incident inclusion decisions, classification judgments, taxonomy applications, and analytical interpretations are reviewed and validated by human editors prior to publication.
AI does not determine incident validity, taxonomy structure, prevention mappings, or analytical conclusions.
CSF Rule Alignment Analysis
In addition to taxonomy classification and prevention normalization, CW13 incident patterns are evaluated against the Crypto Safety First (CSF) Defensive Canon.
The CSF rule registry contains four rule layers:
– Golden Rules (GR)
– Operational Rules (OR)
– Scam Defense Rules (SDR)
– Technical Security Rules (TSR)
This evaluation examines whether the earliest preventable failure boundaries observed in the CW13 incident corpus correspond to one or more rules already present in the CSF registry.
Rule alignment analysis is conducted as a research layer only.
It does not influence:
– incident classification
– taxonomy structure
– prevention normalization
– weekly synthesis conclusions
The purpose of this evaluation is to assess how frequently observed loss mechanisms correspond to existing defensive rules and to identify potential recurrence clusters that may justify future rule creation or rule refinement.
Governance Position
Canonical authority resides in:
– incidents.csv
– taxonomy_report
– prevention_report
– manifest.md
This narrative digest is a publication-layer rendering of those artifacts and does not override them.
