Web3 Attack Matrix

Reconnaissance (R)
Smart Contract Vulnerability Scan
DEX (decentralized exchange) Vulnerability Scan
Website / Social Media / Frontend Vulnerability Scan
Fake Coin/Token Candidate Identification
Fake App Candidate Identification
Popular Messenger Group Identification
Scam Victim Identification
Scam Story Identification
Influencer / Accomplice Identification
Ponzi Scheme Identification
Malware Identification
Mem Pool Observation

Resource Development(RD)
Coin/Token/NTF Creation
Scam Tool Development
Malware Development (Script / Smart Contract / DEX / DeFi Platform)
Initial (Scam) Coin Offering
Smart Contract Exploitation
Bot Development
Game / d(App) Development
Referral System Development
Scam Storyline Creation
Scam Service / Account Creation
Account / Website Takeover
Scam campaign Preparation
Credential Stuffing
Network Profiling
Scam/Fake Offering Creation + Ponzi Scheme Creation
Create Bait for Scam Game

Initial Access (IA)
Airdrop
Fake Token/Coin Listing
Malicious Transaction
Scam Posting of Account Secrets
Forged Address Phishing
Malicious Script/Code/Hyperlink Injection
Targeted Contacting
Account Takeover
Malware (Fake Software Release)
Malicious Wallet Approval
Zero Transfer Phishing
Phishing
Server Access
Validator Privileges
DNS Hijacking
Proxy Phishing NFTs
FOMO (Fear of missing out via Spartacus Attack)
FUD (Fear, Uncertainty and Doubt via Spartacus Attack)

Smart Contract Exploit (E)
Maximal Extractable Value (MEV) Attack
Privilege Escalation in Smart Contracts
Uninitialized Storage Pointers
Default Visibility
Integer Overflow/Underflow
Block Timestamp Manipulation
Constructors with Care
Cross-Chain Bridge Attacks
Crypto-Jacking
Automated Wallet Draining

Credential Access (CA)
Private Keys / Seed Phrase Sharing
Exchange Account Theft
Social Media Credential Theft
Private Key Theft

Command and Control (CC)
51% Attack
Eclipse Attack
Sybil Attack
Fake or compromised validator nodes
Malicious Smart Contracts
Backdoor

Exfiltration (EF)
Payment Diversion (by Smart Contract)
Rug Pull
Wallet Connection to Malicious Smart Contract
Malicious Service
Coin Swap on DEX
Donation to Charity Scam
Personal Data Sharing
Ponzi Purchase
Use of Fake Tools
Atomic Swaps

Impact (I)
Loss of assets
Loss of personal data
Devalued Assets
Loss of Control over Wallets and Funds
Fees spent
Higher Slippage
Disproportionate Influence over Decisions (via Sybil Attack)
Double Spending

Off-Ramp (OR)
Mixing
Chain Hopping
CoinJoin Transaction
Privacy Coins / Encryption
P2P / over the counter
Non-KYC Exchanges