Any given week Web3 security incidents land in news sites or social media. This is not just a matter of the total amount of “hacks” happening but of a trademark of public blockchain technologies: the information is open to everyone. When a project’s funds get drained anyone can watch it in real-time, if a convoluted multi-stage attack is carried out anyone can analyze it, when a wallet tries to scatter funds they can be tracked (with some exceptions). The blockchain’s transparency made it clear for every player in the ecosystem: security should be the baseline, not a last-minute patch. It should be noted that not every security incident is rooted in a Decentralized Application (DApp) vulnerability. This chapter focuses on the security risks of smart contracts, but most thefts of funds out there are related to scams, social engineering, phishing, and the like. These techniques are well-known by traditional Web2 cybercriminals, they need some additional twists but the main target is still the same: the end user. Although security awareness training is out of the scope of this chapter, it is a cornerstone on the road to mass adoption.