Blockchain Attacks and Defenses: A Layered and Cross-Domain Survey

Jul 16, 2026

Blockchain systems have transformed from simple distributed ledgers into programmable platforms that execute high-value application logic, shifting the attack surface from isolated infrastructure disruption to programmable economic abuse and cross-domain exploits. This survey categorizes blockchain threats and defenses using a four-tier layered architecture (network, cryptographic, consensus, application) and cross-domain trust boundaries. It reviews how blockchain security research evolved over the past decade, especially with DeFi and cross-chain interoperability.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages35

Reading Time1 h 28 min

Introduction

Background and Motivation

Limitations of Existing Surveys

Layered and Cross-Domain Taxonomy

Threat Landscape and Mitigation Strategies

Evolution of Blockchain Security Research

DeFi, MEV, and Cross-Chain Interoperability

arXiv :2607 .06593v 1 [ cs .CR] 6 Jul 2026 Blockchain Attacks and Defenses: A Layered and Cross-Domain Survey JUNJIE HU and NA RUAN, School of Computer Science, Shanghai Jiao Tong University, China Blockchains have evolved from simple distributed ledgers into programmable platforms that process complex application logic and carry significant financial value. All modern Web3 systems share a common goal: providing secure, decentralized, and trustworthy execution in an increasingly interconnected environment. However, this evolution has shifted the attack surface from isolated infrastructure disruptions to programmable economic abuse and cross-domain exploits. In this article, we focus on the research of blockchain attacks and defenses. In particular, we categorize the threat landscape and corresponding mitigation strategies according to both a four-tier layered architecture (network, cryptographic, consensus, and application) and crossdomain trust boundaries. We seek to answer these important questions: How has the research in blockchain security evolved over the past decade, especially with the rise of decentralized finance (DeFi) and cross-chain interoperability? How do local security assumptions fail when protocols are composed, and what are the driving needs for Web3 security research in the future? CCS Concepts: • Security and privacy → Distributed systems security; Economics of security and privacy. Additional Key Words and Phrases: Blockchain security, Web3 security, smart contracts, DeFi, consensus, MEV, cross-chain bridges ACM Reference Format: Junjie Hu and Na Ruan. 2026. Blockchain Attacks and Defenses: A Layered and Cross-Domain Survey. 1, 1 (July 2026), 35 pages. [https://doi.org/10.1145/nnnnnnn.nnnnnnn](https://doi.org/10.1145/nnnnnnn.nnnnnnn) 1 Introduction 1.1 Background and Motivation Over the past decade, blockchains have evolved from single-asset ledgers [24] into programmable settlement platforms. Unlike distributed databases focused on replication [177], smart-contract systems execute DeFi and Web3 workflows under open, irreversible, and financially valuable conditions. This coupling changes the threat model: a small implementation bug or economic misconfiguration can immediately become a large loss. The locus of blockchain security has shifted from infrastructure disruption to programmable economic abuse (Figure 2) . Early attacks targeted P2P networks and consensus bounds; later work focused on smart-contract bytecode flaws. Modern attacks increasingly exploit assumption mismatches—the gap between a protocol’s local guarantee and how other systems consume it. Recent work on PoS incentives, fee rules, MEV, validator deanonymization, and zkEVM soundness shows that these risks now interact within the same adversarial economy [94, 98, 130, 139, 166, 236] . Authors’ Contact Information: Junjie Hu, [nakamoto@sjtu.edu.cn](nakamoto@sjtu.edu.cn); Na Ruan, [naruan@sjtu.edu.cn](naruan@sjtu.edu.cn), School of Computer Science, Shanghai Jiao Tong University, Shanghai, China. This research has received support from National Key R&D Program of China (2023YFB2704700), National Natural Science Foundation of China (62472276), and Science and Technology Project of the State Grid Corporation of China (5700- 202321603A-3-2-ZN) . Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires [prior specific permission and/or a fee. Request permissions from permissions@acm.org](prior specific permission and/or a fee. Request permissions from permissions@acm.org). © 202

FAQs

What major change in the blockchain threat model is emphasized in the survey?

Security risks shift from infrastructure disruption to programmable economic abuse, where economic misconfiguration and implementation bugs can trigger large losses across interconnected components.

How does the survey organize attacks and defenses?

It uses a four-tier layered architecture—network, cryptographic, consensus, and application—combined with cross-domain trust boundaries.

What gaps does the survey claim exist in earlier blockchain security surveys?

Earlier work is described as outdated in scope, siloed in analysis, and uneven in evidence, often underdeveloping DeFi/oracles/L2 issues and failing to connect network, consensus incentives, MEV, and application logic.

Jul 16, 2026

Upload by River Wang