Fake LinkedIn crypto job scams cost $11.8M in Singapore

Singapore’s authorities are sounding the alarm on a scam operation that has siphoned roughly $11.8 million from cryptocurrency firms, and the attack vector is one most people wouldn’t think twice about: a LinkedIn job offer.

A joint alert from the Singapore Police Force and the Cyber Security Agency of Singapore details how attackers posing as recruiters for legitimate crypto companies lured victims through fake hiring processes, ultimately planting malware that gave them the keys to corporate code repositories. From there, they rewrote the rules, literally, modifying software to bypass transaction limits and funnel crypto out the door.

The anatomy of a very polished con

Fake recruiters reach out to targets on LinkedIn, typically employees at crypto-related firms. Eventually, the victim is invited to a video interview. The interviewer never turns on their camera. The call happens over Google Meet, communication flows through spoofed email domains.

Then comes the technical assessment. Candidates are directed to what appears to be a standard coding challenge platform. It’s not. The site is spoofed, and the moment a victim downloads the assessment files, malware quietly installs itself on their machine.

The malware harvests session tokens, the temporary credentials that prove to a system you’ve already logged in. By stealing these tokens, the attackers sidestep multi-factor authentication entirely.

With valid session tokens in hand, the attackers accessed Bitbucket accounts, a widely used code repository platform. Once inside the codebase, they could modify the actual software running at these crypto firms, altering transaction limits and security checks to enable unauthorized transfers.

Why this attack is different

Instead of targeting individual retail holders, the attackers went after employees inside crypto organizations. The S$15.1 million (roughly $11.8 million) in reported losses reflects the efficiency of that approach.

Session token theft makes MFA a speed bump rather than a wall. If an attacker can clone your authenticated session, it doesn’t matter how many authentication factors you stacked up to create it.

The LinkedIn problem

Singapore’s advisory specifically urges individuals to verify job offers through official company channels before engaging with any recruiter. The agencies also warn against downloading files from unknown sources, even when they’re presented as part of a legitimate-seeming hiring process.

What crypto firms should watch for

Session management policies need scrutiny. Token lifetimes should be short. Access to production code should require more than a single authenticated session. And hiring processes need their own security protocols to ensure that people conducting interviews are actually who they claim to be.

The $11.8 million in losses reported so far likely understates the full scope. Singapore’s willingness to issue a public advisory suggests authorities believe the campaign is ongoing and that more firms may be at risk.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.