> ## Content Index > Fetch the complete content index at: https://stablecoininsider.org/llms.txt > Use this file to discover other available public pages before exploring further. # Why Do Businesses Lose Stablecoins? - URL: https://stablecoininsider.org/why-businesses-lose-stablecoins/ - Published: 2026-09-24T09:45:40.000Z - Updated: 2026-09-24T09:45:40.000Z - Description: Off-chain incidents accounted for 80.5% of funds lost in 2024. Companies are not losing stablecoins to smart contract exploits. They are losing them to people. - Author: Milos Djukanovic - Tags: Fundamentals, Stablecoins The security coverage that reaches most people is about code. Reentrancy bugs, oracle manipulation, exploited lending markets, nine-figure protocol drains. Those events are real and they are not how a normal company loses money. Halborn's analysis of DeFi incidents found that off-chain events accounted for 56.5% of attacks and 80.5% of funds lost in 2024\. The overwhelming majority of value did not leave through a contract flaw. It left because someone was tricked, someone still had access they should not have had, or one device held one key. > A company with a stablecoin treasury is not defending a protocol. It is defending an approvals process, a set of people, and a short list of devices, which is a much older security problem wearing new clothes. ### Key Takeaways - **Off-chain incidents caused most losses.** 80.5% of funds in 2024. - **Attackers target people, not contracts.** Payment instructions are the entry point. - **Standing approvals are the quiet risk.** Revoke what you stopped using. - **Offboarding is a security event.** Access should follow employment. - **Single-signer treasuries fail completely.** One device empties everything. --- ## What Off-Chain Actually Means The distinction matters because it determines where defensive effort belongs. An on-chain incident exploits the logic of a contract. An off-chain incident exploits everything around it: private keys, administrative accounts, internal processes, and the humans who approve payments. The contract behaves correctly in every case, which is precisely why the loss is unrecoverable. For a business holding stablecoins for payments or treasury, on-chain risk is largely someone else's problem, since you are using tokens rather than writing protocols. Off-chain risk is entirely yours, and the patterns behind it are documented in our guide to [**stablecoin scams**](https://stablecoininsider.org/stablecoin-scams/). **What to note:** auditing the contract you use is worth almost nothing if the approval process around it is weak. [![Stablecoin Scams: The Top 10 Patterns and How to Spot Them Fast](https://storage.ghost.io/c/73/6a/736af0e4-2274-4543-a329-2952b2b52abc/content/images/2026/09/Screenshot-2026-09-24-at-11.26.25.png)](https://stablecoininsider.org/stablecoin-scams/) --- ## Vector One: Payment Instruction Fraud This is the most common way businesses lose stablecoins, and it involves no technical compromise of anything on-chain. An attacker gains access to an email account or impersonates a known supplier, then sends a routine-looking message updating payment details to a new wallet address. The payment is approved through the normal process, executed correctly, and lands with the attacker. Business email compromise has worked against wire transfers for years. Stablecoins make it materially worse, because a wire can sometimes be recalled within hours and an on-chain transfer cannot be recalled at all. **What to note:** any change to a payment address should be confirmed by voice on a number you already hold, never by replying to the message that requested it. --- ## Vector Two: Standing Approvals The second vector is invisible until it fires, because nothing appears wrong in the meantime. Interacting with a contract usually requires granting it permission to spend your tokens, and many interfaces request an unlimited allowance by default. That permission persists after you stop using the application, so a contract compromised in 2027 can still drain a wallet that approved it in 2026. The exposure accumulates quietly. A treasury wallet used across several protocols may carry a dozen standing approvals nobody has reviewed since they were granted. Reviewing them is a routine task rather than a project, and it belongs on the same schedule as every other periodic control in our [**stablecoin risk checklist**](https://stablecoininsider.org/stablecoin-risk-checklist/). **What to note:** review and revoke approvals on a schedule, and cap them at the amount actually needed rather than accepting the default. [![Stablecoin Risk Checklist for Beginners in 2026: 12 Questions Before You Trust Any Token](https://storage.ghost.io/c/73/6a/736af0e4-2274-4543-a329-2952b2b52abc/content/images/2026/09/Screenshot-2026-09-24-at-11.26.49.png)](https://stablecoininsider.org/stablecoin-risk-checklist/) --- ## Vector Three: Access That Outlives the Person This is the vector most companies discover during an incident rather than before one. People join, change roles, and leave. Wallet access, signer keys, custody logins, and exchange credentials are granted when someone needs them and removed only when someone remembers. A former employee with a signing key is not a hypothetical risk, and neither is a current employee whose role changed two years ago. The fix is administrative rather than technical. Access has to be tied to employment status and reviewed when that status changes, which means the security control lives in the same place as the roster. For smaller teams that record is often improvised, which is why offboarding gets missed. Free employee [**scheduling and time tracking**](https://gotrk1.com/o/click/0a34e7a0-7979-4f0b-94e0-9cba6151a0fb/c20ab0e5-fe41-4df3-82e6-b29278e085d9?p%5Fclick%5Fid=[CLICK%5FID]) for your team keeps roles and status in one place so access reviews have something to reconcile against, and you add payroll & HR when you need it. No card or code required. **What to note:** run an access review every time someone leaves, not every quarter. [![Homebase](https://storage.ghost.io/c/73/6a/736af0e4-2274-4543-a329-2952b2b52abc/content/images/2026/09/Screenshot-2026-09-24-at-11.27.17.png)](https://www.joinhomebase.com/solutions?irclickid=Rgt1oJWMSxyZUoiRNvxgC3hgUkrzL5SxCThKXc0&sharedid=&utm%5Fcampaign=2959690&utm%5Fsource=impact&utm%5Fmedium=affiliate&irgwc=1&afsrc=1) --- ## Vector Four: Single-Signer Operations Concentration turns a device compromise into a total loss. Where one person holds one key that can move the entire treasury, the attack surface is that person's laptop, phone, and browser. Malware, a malicious extension, or a convincing phishing page produces an outcome no policy can reverse. Multisignature and threshold arrangements change the arithmetic, since an attacker now needs several independent compromises rather than one. The trade-off is operational friction, which is exactly why small teams skip it and exactly why they should not. **What to note:** match the number of required signatures to the balance at risk rather than to the team's tolerance for inconvenience. --- ## Vector Five: Address Poisoning This attack exploits habit rather than technology. The attacker sends a tiny transfer from an address engineered to resemble one you use, matching the first and last characters. It then appears in your transaction history, and the next time someone copies an address from that history rather than from the verified source, the payment goes to the attacker. It works because verification behaviour is usually to check the first four and last four characters, which is exactly what the attacker matched. **What to note:** copy addresses from your own records, never from transaction history, and verify the full string for anything material. --- ## What Actually Reduces Risk The effective controls are unglamorous and mostly free. Separate a small hot wallet for operational payments from a cold or multisig treasury, so a compromise of the working account cannot reach the reserve. Require out-of-band confirmation for any new or changed payment destination. Send a test transaction before any material transfer. Review approvals and access on a defined schedule rather than when something prompts it. None of those requires security expertise, and together they address the vectors responsible for most losses. The wider operational structure that limits the blast radius is covered in our guide to [**stablecoin treasury setup**](https://stablecoininsider.org/stablecoin-treasury/). **What to note:** the controls that prevent the largest losses are process controls, not products. [![How to Set Up a Stablecoin Treasury: Wallet Policy, Access Controls, and Reconciliation](https://storage.ghost.io/c/73/6a/736af0e4-2274-4543-a329-2952b2b52abc/content/images/2026/09/Screenshot-2026-09-24-at-11.27.44.png)](https://stablecoininsider.org/stablecoin-treasury/) --- ## What to Do After an Incident Speed matters more than diagnosis in the first hour. Move remaining funds to a wallet generated on a clean device, revoke every approval on the compromised address, and disconnect active sessions. Preserve transaction hashes and screenshots before doing anything else, since those are the only evidence that exists. Where funds were stolen rather than misdirected, report through law enforcement rather than to the issuer directly, because issuer freezes generally require legal process rather than a victim report. **What to note:** assume the compromised wallet stays compromised and never reuse it. --- ## The Structural Prerequisite One control sits underneath the others and is easy to overlook. Institutional custody, multisignature services with recovery support, business exchange accounts, and commercial insurance all require a registered legal entity. A founder holding company funds in a personal wallet has none of those options available, and has also merged personal and business exposure into a single point of failure. If the business is not yet incorporated, you can [**register your FREE LLC**](https://gotrk1.com/o/click/fd67b8ab-a1e8-4a2b-a339-1635ebeea2bf/5912f4d9-3b22-4aec-9fd8-1af263dd367c?p%5Fclick%5Fid=[CLICK%5FID]) today and unlock the tier of custody and account controls that only exist for entities. **What to note:** separating company funds from personal ones is a security control before it is an accounting one. [![IncAuthority](https://storage.ghost.io/c/73/6a/736af0e4-2274-4543-a329-2952b2b52abc/content/images/2026/09/Screenshot-2026-09-24-at-11.28.12.png)](https://www.incauthority.com/start-free/impact?im%5Fref=zNKQxgWNuxyZUoiRNvxgC3hgUkrzL%3A2BCThKXc0&sharedid=&irpid=2959690&utm%5Fsource=impact&utm%5Flc=impact&utm%5Firpid=2959690&irgwc=1&afsrc=1) --- ## Conclusion Why do businesses lose stablecoins? Overwhelmingly through off-chain failures, which accounted for 80.5% of funds lost in 2024, rather than through the contract exploits that dominate coverage. The five vectors behind most of it are payment instruction fraud, standing approvals, access that outlives the person who needed it, single-signer operations, and address poisoning. None of them attacks a blockchain, and all of them attack a process. That is better news than it sounds. Protocol security requires expertise a payments team does not have, while out-of-band confirmation, scheduled approval reviews, offboarding discipline, and a second signature are within reach of any company that decides they matter before an incident rather than after one. ***Read Next:*** - [**Stablecoin Risk Checklist**](https://stablecoininsider.org/stablecoin-risk-checklist/) - [**Stablecoin Scams**](https://stablecoininsider.org/stablecoin-scams/) - [**Stablecoin Treasury Setup**](https://stablecoininsider.org/stablecoin-treasury/) --- ## FAQs: ### 1\. How do most businesses actually lose stablecoins? Through off-chain failures rather than smart contract exploits. Halborn's analysis of DeFi incidents found off-chain events accounted for 56.5% of attacks and 80.5% of funds lost in 2024, driven by compromised keys, manipulated payment instructions, stale access, and single-device operations. ### 2\. What is payment instruction fraud? An attacker gains access to an email account or impersonates a supplier, then sends a routine-looking message updating payment details to a new wallet address. The payment is approved normally and lands with the attacker, and unlike a wire transfer it cannot be recalled. ### 3\. Why are token approvals a security risk? Because they persist. Many interfaces request an unlimited allowance by default, and that permission survives after you stop using the application, so a contract compromised later can still drain a wallet that approved it earlier. Approvals should be capped and reviewed on a schedule. ### 4\. What is address poisoning? An attacker sends a tiny transfer from an address engineered to match the first and last characters of one you use, so it appears in your transaction history. The next time someone copies an address from history rather than from a verified record, the payment goes to the attacker. ### 5\. What should a small company do first? Separate a small operational hot wallet from a multisig or cold treasury, require out-of-band confirmation for any changed payment address, send a test transaction before material transfers, and review approvals and access whenever someone changes role or leaves. --- ***Disclaimer:*** This content is provided for informational and educational purposes only and does not constitute financial, investment, legal, or tax advice; no material herein should be interpreted as a recommendation, endorsement, or solicitation to buy or sell any financial instrument, and readers should conduct their own independent research or consult a qualified professional.