Read incident coverage one story at a time and every event looks novel. Read a tracker and the same shapes come back. The value of a structured record is that it makes the repetition visible.
Almost none of it is broken cryptography. Overwhelmingly, the failures are about who could authorise what.
Key compromise
Someone obtained a key that could move funds. Not a mathematical break — a compromised machine, a malicious dependency, a targeted individual, or a key that was weakly generated in the first place. This is the largest class in our records by some distance; the Incident Tracker lets you filter it directly.
Signing interface compromise
The key was never stolen. Its holder was shown one thing and signed another. This is the failure mode that makes blind signing matter, and it is why what a signing device displays is a separate claim from what the interface displays.
Authorisation and access control
A function that should have been restricted was reachable, or an allowlist was misconfigured, or an initialisation step left a role unset. Bridge records cluster here, because a bridge is largely a mechanism for deciding whether a release is authorised — see validator set.
Trusted input
The system believed something it should have verified: a price it could not defend, a vote weight that could be rented for one block, a message it had already processed. Oracle manipulation, governance attacks and replay attacks are all this shape.
Supply chain
The compromise was upstream, in something the project depended on rather than in the project. A supply chain attack reaches every user of the dependency at once, which is why this class produces unusually broad incidents relative to the effort involved.
Why the classification is useful
Because it tells you what a given control actually buys. A hardware wallet addresses key storage; it does not address being shown the wrong transaction. An audit addresses contract logic; it does not address who holds the upgrade key. Matching a defence to the class it defends against is most of practical security, and it is very hard to do while thinking one incident at a time.
Every record in our tracker is tagged with its attack class, so you can read a class rather than a chronology.
Not advice. Conisec reports for information only. Nothing in this article is financial, legal, tax or security advice. Verify against the primary sources linked above before acting on anything.
