HACK3D: The Web3 Security Quarterly Report - Q2 2023

2026年上半年共发生52起经核实的暴力胁迫攻击事件，已记录的损失金额达1.241亿美元。事件数量同比增长33.3%，损失金额增至此前的11.8倍，且威胁进一步集中于西欧，逐渐演变为一场区域性危机。

Web3 security losses exceeded $1.31 billion in H1 2026 across 344 incidents, with wallet compromise emerging as the most financially destructive attack vector and phishing shifting toward fewer, higher-value social engineering attacks.

This article analyzes that security model across the full asset-control lifecycle. It traces a single transaction through Clave's open-source implementation, surveys past vulnerabilities in WebAuthn, FIDO2, and CTAP, maps them onto the lifecycle of a typical Passkey Wallet, and ends with implementation checks for teams building one.