Social engineering has become the most devastating attack vector in crypto, accounting for the majority of stolen assets in 2025. Unlike exploits that target code vulnerabilities, these attacks manipulate human psychology—tricking users into surrendering private keys, seed phrases, or authentication credentials through impersonation, phishing, or pretexting. The FBI's latest data underscores the severity: crypto fraud losses reached $11 billion last year, a 22% increase from the prior period. Casa, a established custody and security firm, has responded by deploying four new features designed to raise the friction for social engineers attempting to compromise their users' bitcoin holdings.
The underlying challenge is that security tooling often assumes threats come exclusively from external actors breaching systems. But social engineering bypasses infrastructure entirely—it targets the person holding the keys. An attacker who successfully convinces a user they're speaking with legitimate support staff, or who impersonates a trusted contact, can extract the information needed to move funds without ever touching a firewall. This is why companies like Casa focus on behavioral verification and anomaly detection. The four features rolling out to Casa's customer base likely incorporate identity confirmation protocols, unusual activity alerts, and transaction approval workflows that require multiple verification steps—effectively inserting human judgment checkpoints into the withdrawal process.
What makes Casa's approach noteworthy is the acknowledgment that custody providers must evolve beyond passphrase storage and cold wallet mechanics. As hackers' social engineering playbooks become more sophisticated, firms offering self-directed or semi-custodial bitcoin solutions need to bundle authentication systems that validate not just *what* someone knows, but whether the request matches historical patterns. This could include geolocation checks, time-lock delays on withdrawals, or notifications to backup security contacts before large transfers execute. The goal isn't to create friction that breaks usability, but to embed enough procedural steps that impersonation becomes impractical.
Casa's initiative reflects a broader industry maturation toward defense-in-depth security architecture. As institutional adoption continues and more retail users custodize significant bitcoin positions, the burden on platforms to prevent social engineering attacks will only intensify—making this category of preventative tooling a key differentiator in the custody market going forward.