The session token is the ghost of the architect’s intent. On a quiet Tuesday in Singapore, an attacker used a stolen token to walk past MFA and into a crypto company’s CI/CD pipeline. The cost: $11.8 million. The media called it a recruitment scam. I call it a supply chain attack dressed in a LinkedIn profile.
This was not a zero-day exploit. It was not a smart contract vulnerability. It was a human, a process, and a technology failure—layered like a phishing campaign but executed with the precision of a nation-state actor. The attackers impersonated recruiters, conducted fake Google Meet interviews with cameras off, and convinced a candidate to download a “technical test” that was actually a remote access trojan. Once inside, they stole session tokens, bypassed multi-factor authentication, accessed Bitbucket repositories, modified deployment instructions, and transferred funds out of the company’s treasury. The entire chain took less than 48 hours.
Context: The Architecture of Trust
The victim was a Singapore-based cryptocurrency firm—likely a licensed exchange or custody provider, given the existence of transaction limits and approval workflows. Singapore’s Payment Services Act requires such firms to implement robust security controls, but the attack exposed a gap between regulatory intent and operational reality. The attackers didn’t target the blockchain; they targeted the 9-to-5 workflow of a crypto company. They understood that the most valuable asset of a Web3 enterprise is not the private keys stored in a hardware wallet, but the credentials and tokens that flow through its internal systems every day.
This attack is a case study in trust chain exploitation. The recruitment process is inherently trust-based: a company seeks talent, a candidate seeks employment. The attacker weaponized that mutual trust. They created a fake domain, sent emails from a lookalike address, and used a legitimate video conferencing tool to establish credibility. The “technical test” was a plausible request—many companies ask candidates to complete coding exercises. The malware was disguised as a common development tool. The victim had no reason to suspect that the interview was a phish.
Core: The Technical Heart of the Attack
Let me walk through the technical chain, because that is where the real story lies. Based on my experience auditing smart contracts in Zurich, I learned to look for the moment when the system’s assumptions break. Here, the break occurred at the session token.
- Initial Access: The malware installed on the candidate’s machine (likely a company-issued laptop) provided a foothold. The attacker captured keystrokes, screenshots, and clipboard data. But the critical step was the theft of session tokens—the cookies that authenticate a user to internal services like Bitbucket, Jira, and CI/CD tools. These tokens are often long-lived, sometimes lasting 30 to 90 days. They are designed for convenience, not security.
- MFA Bypass: Multi-factor authentication is the darling of security compliance. Every auditor recommends it. But MFA only protects login. Once a session token is established, the system trusts that token for the duration of its life. Attackers who steal the token can impersonate the user without ever triggering an MFA prompt. This is the session hijacking technique that made the attack possible. The company likely had MFA enabled, but it was useless against a stolen token.
- Lateral Movement: With the Bitbucket token, the attacker accessed the code repository. They did not need to exploit a vulnerability in the code; they simply read the deployment scripts. They found the API keys for the CI/CD pipeline, the environment variables for the production server, and the wallet addresses for the company’s treasury. They then modified the deployment script to redirect funds to their own wallets during the next automated release.
- Fund Transfer: The final step was a classic supply chain attack on the DevOps pipeline. The CI/CD system was designed to trust the instructions in the repository. The attacker altered those instructions, and the system executed them without human verification. The funds—$11.8 million in stablecoins, likely USDT or USDC—were transferred to a series of addresses controlled by the attacker. The transaction limits and approval workflows were bypassed because the attacker used the stolen credentials of a legitimate user who had the authority to approve large transfers.
When the pool empties, only the intent remains. The attacker’s intent was clear: exploit the gap between the promise of Web3 decentralization and the reality of centralized corporate IT. They did not need to break the blockchain; they needed to break the trust in the pipeline.
Contrarian: The Blind Spots We Refuse to See
The common narrative is that this is just another crypto hack—a lesson in due diligence for job seekers. But that is a comfortable lie. The real story is about the failure of the industry’s security paradigm. We have spent billions on smart contract audits, formal verification, and bug bounties. We have built trustless systems for on-chain transactions. Yet we have ignored the soft underbelly: the operational security of the humans and processes that manage those systems.
Here is the contrarian truth: The attack was not a failure of technology; it was a failure of governance. The company had a multi-factor authentication policy, but it did not enforce session expiration. It had a transaction approval workflow, but it relied on static credentials. It had a code review process, but it did not verify the integrity of CI/CD instructions. The attack exploited a gap between what the company thought it was securing and what it actually secured. This is a classic blind spot in the crypto industry: we are so focused on the chain that we forget the office.
Moreover, the response from the Singapore authorities—while commendable in its transparency—may inadvertently exacerbate the problem. By framing this as a “recruitment scam,” they shift the responsibility to job seekers. The advice to “verify the company’s identity” is necessary but insufficient. The real burden lies on the companies: they must design their systems to assume that every employee’s machine is compromised. That means implementing continuous authentication, device trust scores, and hardware-backed session management. It means treating the CI/CD pipeline as a critical asset that requires multi-signature approval for every deployment. It means auditing not just the code, but the process.
Takeaway: The Next Narrative
The session token is the new private key. In the coming years, we will see a shift from “on-chain security” to “operational security.” The market will demand solutions that protect the pipeline, not just the wallet. Companies will need to adopt zero-trust architectures where every session is verified, every deployment is signed, and every job interview is treated as a potential attack vector.
The question is not whether this attack will be replicated—it will. The question is whether the industry will learn from the ghost in the pipeline. To own a piece of art is to inherit its narrative. To own a crypto company is to inherit its vulnerabilities. How many more will hire a ghost before they realize the pipeline is the wallet?
