Web3 Fake Interview Wallet Theft Scam: Impersonating Crypto Companies to Steal Assets via Wallet Authorization

Who Gets Targeted

The primary victims are job seekers with experience in blockchain and smart contract development, as well as investors and developers eyeing high-paying roles in the crypto sector. These individuals are often confident in their technical skills but lack sufficient vigilance regarding crypto wallet interaction risks. Eager to enter the lucrative blockchain industry, they are easily misled by unsolicited invitations on professional platforms, falling for carefully crafted technical tests during interviews, lowering their guard against plugin downloads and wallet authorizations, ultimately leading to the instant theft of their crypto assets.

骗局怎么运作

• Scammers forge recruiter identities on professional social platforms, linking them to high-fidelity clones of well-known crypto companies or licensed service providers, and send high-paying job offers to candidates with blockchain backgrounds, leveraging the industry's recovery phase to lower their guard.
• After establishing initial contact, scammers request an online interview via popular video conferencing software under the guise of technical assessment or business environment familiarization, inducing the candidate to download specific screen-sharing plugins or 'system compatibility tests' that are actually malicious Trojans.
• During the interview, the fake interviewer builds technical trust with professional questions, then directs the candidate to a specific test website, claiming it is for testing smart contract interactions or configuring a development environment, and induces them to connect their personal crypto wallet to the malicious phishing site.
• When the candidate follows instructions to connect their wallet and sign what appears to be a routine test authorization or blind signature transaction, they are actually granting the scammer's smart contract address permission to operate their wallet assets, while the background screen sync steals the underlying private key data.
• Once authorization is complete, the scammer's background program automatically triggers a transfer, instantly moving digital assets like Bitcoin and Ethereum from the victim's wallet to a mixer for laundering, while cutting off all contact. The victim only realizes they have been scammed once their wallet is emptied.

红旗信号（看到这些快跑）

• 🚩 The recruiter initiates contact on professional social platforms, but their account is newly created with few connections, and the company name on their profile has subtle spelling differences from the official domain.
• 🚩 The interview invitation bypasses formal corporate recruitment systems, demanding the download of third-party conferencing software or obscure browser plugins not verified by app stores, citing 'system compatibility' as the reason.
• 🚩 The interview process is abnormally short, with superficial technical questions, yet they are eager to move to a 'practical assessment' and insist on the candidate connecting a personal mainnet wallet to a specified testnet or unknown website.
• 🚩 So-called test questions require the candidate to provide their wallet's seed phrase or private key to 'verify asset consistency,' or require signing on a website that has not undergone third-party code audits.
• 🚩 The salary package far exceeds industry averages, the job description is extremely vague, and the interviewer is evasive about specific start dates or responsibilities, focusing entirely on getting the candidate to complete wallet connections and authorizations.

真实案例

• Singapore police reported that a victim received a fake crypto job offer via a professional social platform, was induced to participate in an online interview and download malicious software, ultimately losing control of their crypto wallet, resulting in the theft of approximately $11.8 million in crypto assets.
• According to a case analysis by Shanghai Mankun Law Firm, a job seeker was induced to connect to a frontend testnet and sign an authorization during a fake online interview, resulting in their wallet being instantly drained—turning an online interview into a gateway for wallet theft.
• Cybersecurity media reports reveal that transnational hacker groups frequently use fake recruitment for well-known blockchain projects to conduct online interviews, planting Trojans to steal developers' wallet assets. Annual fake DeFi phishing attacks have caused severe asset losses for the developer community.
• In August 2026, the Singapore Police Force and the Cyber Security Agency issued a joint alert: a phishing attack disguised as recruitment led to the theft of approximately $11.8 million in crypto assets; attackers posed as crypto recruiters on LinkedIn, using spoofed domain emails and video interviews with cameras turned off to induce the download of malicious software, breaching corporate codebases and transferring assets. (Source: https://license.aiying.cc/zh-CN/sg/singapore-linkedin-crypto-job-scam-11-8m-dpt/)
• In August 2026, Channel NewsAsia and AsiaOne reported that Singaporean authorities issued a warning regarding crypto recruitment scams: related cases have led to approximately $11.8 million in losses, with another scam involving fake recruitment and compromised software systems causing over $15 million in losses; Singapore lost approximately S$182.2 million to crypto-related scams in 2025. (Source: https://license.aiying.cc/zh-CN/sg/singapore-linkedin-crypto-job-scam-11-8m-dpt/)

Official Stance

• In August 2026, Singapore police issued an alert warning the public to be vigilant against crypto recruitment scams conducted via professional social platforms, which have caused at least $11.8 million in losses.
• Singaporean compliance agencies issued operational security alerts for licensed Digital Payment Token service providers, reminding practitioners and job seekers of the risk of DPT asset theft resulting from fake recruitment.
• Security awareness blogs issued warnings highlighting the surge in 'fake interview, real theft' phishing attacks targeting crypto developers, reminding job seekers never to connect mainnet wallets or download unknown software during interviews.

How to Protect Yourself

• ✅ Verify the recruiter's identity through contact information provided on the company's official website before the interview, and refuse video interview invitations conducted through unofficial channels or personal social accounts without prior background checks.
• ✅ Firmly refuse any interview requests that require downloading third-party, unknown conferencing software, screen-sharing plugins, or system test programs; use only recognized, standard video conferencing tools.
• ✅ Always use a newly created empty wallet or an official testnet wallet for any technical recruitment tests; never connect a mainnet wallet containing personal assets during an interview, and never provide your seed phrase to anyone.
• ✅ If smart contract interaction is required, demand code reports audited by reputable third-party security firms, and use a blockchain explorer to pre-check the authorization history and risk labels of the target contract address.