Crypto Job Scam Playbook: How a Fake LinkedIn Recruiter Cost One Company $11.8 Million

The most expensive part of a crypto job scam is not the malware. It is the fact that the person clicking is doing something entirely reasonable: looking for a better job.

Scammers posing as recruiters for crypto companies have taken $11.8 million, or S$15.1 million, according to a joint advisory from the Singapore Police Force and the Cyber Security Agency of Singapore. The money did not come out of the applicant's wallet. It came out of the company that employed him.

How the crypto job scam actually ran

The advisory lays out a sequence that is worth reading slowly, because every step looks normal on its own.

First contact came on LinkedIn. Someone presenting themselves as a recruiter at a crypto company reached out with a role. The conversation then moved to email, where the sender used a spoofed domain nearly identical to the real firm's.

Several interviews followed on Google Meet. Throughout all of them, the interviewer kept their camera off.

Then came the technical stage: a link to a spoofed site with a coding assessment. The candidate completed it on a company-issued device. While the assessment ran, malicious software installed itself without any visible sign.

The theft was a session token, not a password

This is the part that defeats the usual advice about strong credentials.

The malware captured a session token - the string a service issues to keep a user logged in after authentication. Because that token represents an already-authenticated session, presenting it skipped multi-factor authentication entirely. No password was cracked. No second factor was phished.

The token opened the victim's Bitbucket account, where the employer stored and managed source code. Accounts like that usually carry rights that reach much further than a code repository: internal systems, cloud environments, deployment pipelines. In this case they did.

From there the attackers altered the automated deployment instructions, which gave them a path into internal infrastructure and remote access to servers. With credentials collected along the way, they bypassed the transaction limits and approval checks that were supposed to govern crypto transfers, and moved the funds out.

The advisory does not name the company, say where the money went, or attribute the operation to anyone.

Why the target was an employee who wanted to leave

Russian-language coverage of the same case foregrounds a detail worth dwelling on: the victim was an employee who was looking to move.

That is the whole design, and it explains why security awareness training keeps failing against this. A phishing email asks someone to do something out of the ordinary. A recruiter asks them to do exactly what a job seeker expects: talk to a stranger, use an unfamiliar domain, sit interviews with people they have never met, and complete a take-home task under time pressure.

Every anomaly the security team would normally flag is, in a hiring context, the standard procedure. And the person on the receiving end has a strong reason not to mention any of it to their current employer.

That produces an uncomfortable conclusion for any crypto company. The likelihood of being attacked this way is a function of how many of your people are quietly job hunting - a number no security dashboard displays.

This is an industry, not an incident

The Singapore case is one line in a much longer file.

Researchers have tracked a long-running campaign known as Contagious Interview, in which fake recruiters steer Web3 developers toward malicious code, including more than 300 booby-trapped packages uploaded to the npm registry. A group known as TraderTraitor has used the same lure to reach corporate cloud systems rather than individual wallets - for the obvious reason that this is where larger balances sit. Others have impersonated recruiters from Coinbase and Uniswap to get targets running commands on their own machines.

Those campaigns are attributed to North Korean operators, but the playbook is not theirs alone. The Russian-speaking group Crazy Evil built an entire fake Web3 company, ChainSeeker.io, and advertised blockchain analyst positions to lure applicants into installing wallet-draining malware.

The timeline is longer than most people assume. MetaMask security researcher Taylor Monahan noted in April that fake IT workers have been embedding themselves in crypto companies and DeFi projects for at least seven years, with the Lazarus group recruiting nationals of other countries to front the applications.

Why crypto firms lose more than everyone else

Fake recruiter campaigns hit every industry. The difference in crypto is what happens after the perimeter breaks.

In a traditional company, an attacker inside the deployment pipeline still has to move money through systems that can reverse a transfer, freeze an account or reconcile a discrepancy the next morning. In a crypto company, the last step is a signed transaction. There is no clearing window and no counterparty to call.

That is why the attackers in the Singapore case went after approval checks and transfer limits rather than simply draining what they could reach. Those controls were the only thing standing between source-code access and an irreversible outflow.

What actually stops it on the company side

Awareness posters do not work here, because the behaviour being exploited is not careless. Controls do.

Separate the machine from the job search. No recruitment task, coding assessment or "environment check" should ever run on a device that holds corporate sessions. A disposable VM is the minimum standard, and it costs nothing.

Bind sessions to something stealable tokens cannot carry. Device-bound credentials, short token lifetimes and re-authentication for high-value actions turn a stolen session into a brief inconvenience rather than a master key.

Treat the deployment pipeline as a financial system. If altering a build configuration can reach production servers, it can reach the wallet. Require separate approval for pipeline changes, and log them where the person making the change cannot edit the record.

Make transfer approvals independent of engineering credentials. In this case, stolen credentials were enough to bypass limits and approvals. If a single compromised identity can both change code and release funds, the limits are decorative.

Watch for unfamiliar devices and unusual network activity - the two signals the Singapore agencies specifically recommend monitoring.

Where a compromise is suspected, the advisory is blunt about sequence: isolate affected systems, revoke active sessions, reset credentials, review access logs. Revoking sessions matters more than resetting passwords, and most incident checklists still have that order backwards.

What to check as an individual

Verify recruiters through official channels - the company's careers page or a direct message to a verified employee, never the contact details supplied in the approach.

Treat an interviewer who will not turn on their camera as a stop signal, not a quirk. Multiple rounds with a permanently dark screen is not shyness.

Never run code from an unverified source, and never on a work device. If a hiring process demands that you execute something to prove your skills, that is the test you should fail on purpose.

Check the domain character by character. Spoofed domains in these campaigns are built to survive a glance, not an inspection.

The wider pattern

This case belongs to the same family as the data breaches that have been feeding targeted attacks on crypto holders all year. In both, the technical exploit is unremarkable. What makes the attack work is context: a leaked address, a stated income, a public job title, a person actively seeking an opportunity.

Attackers stopped trying to break cryptography a long time ago. They now work on the surface where people behave predictably and reasonably - and the hiring pipeline is the most predictable surface a company has.

FAQ

What is a crypto job scam?

An attack in which criminals pose as recruiters for a crypto company and use the hiring process - interviews, technical assessments, onboarding steps - to get a target to install malware or run malicious code, usually to reach the target's employer rather than their personal wallet.

How did the attackers bypass multi-factor authentication?

They did not. Malware captured a session token, which represents an already-authenticated session. Presenting the token made further authentication unnecessary.

Why do attackers target employees instead of wallets directly?

Corporate systems hold larger balances and grant access to deployment pipelines, cloud infrastructure and transfer approvals. Compromising one employee can reach far more value than draining a personal wallet.

What are the warning signs of a fake recruiter?

An approach from an unverified profile, a follow-up domain that only resembles the real company's, interviewers who keep their cameras off across multiple rounds, and any technical assessment that requires running unfamiliar code, especially on a work device.

What should a company do first if it suspects a crypto job scam compromise?

Isolate the affected systems and revoke active sessions before anything else, then reset credentials and review access logs. Because the attack relies on stolen session tokens, a password reset alone leaves the intruder logged in.

Key Takeaways

• Separate the machine from the job search.
• Bind sessions to something stealable tokens cannot carry.
• Treat the deployment pipeline as a financial system.
• Make transfer approvals independent of engineering credentials.
• Watch for unfamiliar devices and unusual network activity