A single download. One invitation. Your private keys are gone. This is not a hypothetical. On July 29, 2025, SlowMist published a forensic breakdown of a new attack chain targeting Web3 professionals. The vector is not a zero-day exploit. It is a custom information stealer disguised as an AI meeting tool called "Relay." The target is your wallet, your browser credentials, your Telegram session. Trust is the bug. The attacker is the feature.
Trust is a bug, not a feature.
Context: The Human Protocol Breach
This attack is not a technical marvel. It is a social engineering operation dressed in code. The attacker creates a fake recruiter profile on LinkedIn—often using a stolen identity of a real industry figure. They reach out to a developer, a founder, a security researcher. The offer is convincing: a remote role at a top Web3 company, high salary, equity tokens. The recruiter asks the candidate to install "Relay," a supposed AI-powered meeting scheduler. The candidate downloads a DMG or EXE file from a link. The file is malware.
SlowMist’s analysis reveals the malware is cross-platform. It targets macOS and Windows equally. On macOS, it accesses the Keychain, the Chrome credential store, the Telegram desktop session folder, and common crypto wallets like MetaMask, Phantom, and Ledger Live. On Windows, it scrapes the same from Chrome’s Login Data, Crypto Wallets extensions, and Telegram’s tdata files. The data is exfiltrated to a command-and-control server. The attacker now has your private keys, your browser passwords, your Telegram OTPs. They can drain your wallet, hijack your accounts, impersonate you to your contacts.
This is not a hypothetical. It has happened. Multiple victims have reported losses. SlowMist has published the file hashes, the C2 domains, the infection markers. The industry now knows the IOCs. But the damage is already done.
I have seen this pattern before. In 2018, I audited the 0x Protocol v2 smart contracts. I found reentrancy vulnerabilities in the exchange logic that previous auditors had missed. The reaction from the team was defensive. They wanted to launch on time. I insisted on a delay. The lesson was clear: speed is the enemy of security. Here, the enemy is not a bug in Solidity. It is a bug in human decision-making. The protocol is trust. The vulnerability is our willingness to click a link.
Code is law; intent is irrelevant.
Core: The Systematic Teardown
Let me dissect the attack layer by layer. This is not a review of a whitepaper. It is a post-mortem of a phishing campaign that will repeat.
Layer 1: The Social Engineering Bait
The attacker conducts reconnaissance. They scan LinkedIn for job postings, for people with "crypto" or "Web3" in their headlines. They build a credible persona: a recruiter from a real or plausible startup, with a history of posts, connections, and endorsements. Some accounts are created months in advance. The effort is non-trivial. But the ROI is astronomical. A single successful breach can yield millions in stolen assets. The cost of setting up a fake profile is near zero.
Layer 2: The Malware Delivery
The attacker sends a direct message: "We loved your profile. Please install Relay for a quick intro call." The link points to a domain that mimics a legitimate AI tool. The landing page looks professional—logo, features, testimonials. The download button triggers the malicious binary. The malware is signed with a stolen or self-issued certificate to bypass macOS Gatekeeper or Windows SmartScreen. SlowMist’s sample shows it is a Golang binary, obfuscated with common packers, but not sophisticated. It does not need to be. The target is eager, not paranoid.
Layer 3: Exfiltration
Once installed, the malware checks for a running debugger or sandbox. If it passes, it executes the payload. It reads the system’s Keychain (macOS) or Credential Manager (Windows). It dumps browser profiles: Chrome, Brave, Edge. It looks for specific wallet extensions by file path. It copies the Telegram session folder—this is critical. Telegram session files allow the attacker to log in as the victim without SMS. The attacker now owns the identity. They can read private chats, join groups, send messages.
The data is sent to a C2 server over HTTPS, often disguised as API calls to a legitimate service like AWS or Cloudflare. The attacker then uses the stolen private keys to sign transactions. They use the browser cookies to access exchange accounts that have no 2FA. They use the Telegram session to message the victim’s colleagues: "Hey, I just found a great job opportunity—check out this link." The attack cascades.
Layer 4: The Failure of Safety Assumptions
Most Web3 professionals believe they are safe because they use hardware wallets. They think their private keys never touch the internet. This is false. The malware does not need your private key if it can steal your mnemonic phrase from a text file, or your browser’s encrypted wallet seed. It can hijack your MetaMask session while you are asleep. It can use your Telegram OTP to reset your 2FA. The attack surface is not the Ledger device. It is the machine that runs the software.
In 2021, I analyzed the Curve Finance gauge voting system. I showed how the incentive model favored whales. The math was clear: retail users were subsidizing early adopters. Here, the math is different but equally cold. The attacker’s incentive is to target high-value individuals. The Web3 professional is the highest-value target. They hold private keys, they have access to privileged information, they control project treasuries. The attack is not random. It is directed.
The ledger does not lie, only the interpreters do.
Layer 5: Historical Parallels
This is not the first time a fake meeting app has been used to steal crypto. In 2023, a similar operation called "Meetup" targeted the crypto community. But that malware was sloppy—it only worked on Windows, and it used a known vulnerable installer. This new variant is polished. It uses Golang for cross-platform compatibility. It encrypts its C2 traffic with TLS. It mimics a legitimate AI product.
History repeats, but the gas fees change. The attack vectors evolve, but the root cause remains the same: we trust too easily. In 2022, during the Terra/Luna collapse, I reverse-engineered the UST de-pegging sequence within 48 hours. I traced the oracle manipulation. The conclusion was that algorithmic stability is a mathematical fallacy. Here, the conclusion is similar: operational trust is a system failure. The assumptions that underpin remote hiring—identity, authenticity, verification—are all broken.
Layer 6: The Compliance Void
Regulators have not touched this. KYC and AML requirements apply to exchanges and custodians, not to LinkedIn profiles. There is no law requiring a recruiter to prove they are real. The burden falls entirely on the individual. This is a structural gap. In 2024, I audited the custody solutions of three asset managers applying for spot Bitcoin ETF approval. I found gaps in their multi-signature key management procedures. They were not ready for institutional scrutiny. The same scrutiny is absent here. A centralized platform like LinkedIn could implement identity verification for recruiters, but they do not. The incentive to do so is low—the reputational damage is spread across the industry, not centralized.
Contrarian: What the Bulls Got Right
Now, the contrarian angle. There are arguments that the threat is overblown. Some will say: "Hardware wallets protect you. Use a dedicated device for crypto. Don’t click unknown links." These are valid. The bulls are not wrong about the solutions. But they miss the point.
The point is that the Web3 industry has built an entire economy on the premise of trust minimization. Smart contracts replace trust with code. Oracles replace trust with data. Yet the hiring process—the gateway to talent—is based on the oldest form of trust: a person’s word. This attacks the fundament. You can have the most secure on-chain protocol, but if your developer downloads malware, the assets are gone. The bulls underestimate the human factor.
Another contrarian point: some will claim that the attack is not scalable. It requires manual targeting. But that is a false comfort. A single attacker can target 100 candidates per day. If 1% install the malware, that is one victim per day. Over a year, that is 365 potential victims. Each victim may hold assets worth thousands to millions. The attack is highly scalable.
Don't just trust the team. Verify the code, verify the human.
Takeaway: The Accountability Call
This attack will not stop. New variants will appear. The AI narrative will evolve—deepfake video interviews where the attacker’s face is a AI-generated avatar. The only defense is radical skepticism. Treat every unsolicited job invitation as a phishing attempt until proven otherwise. Verify the recruiter’s identity through a phone call to a known company number. Use a dedicated machine for all crypto-related activities. Do not run any binary that you did not compile yourself.
For companies: implement a recruiter verification protocol. For platforms: require cryptographic proof of identity for job postings. For regulators: this is a consumer protection issue. The industry must stop relying on user education and start building infrastructure that makes it impossible to send a malicious binary.
I will include my standard compliance checklist here, as I do in every report:
Checklist for Safe Web3 Job Seeking - Verify the recruiter’s LinkedIn profile matches the company’s public domain email. - Never download software from a direct message link. Always go to the official website. - Use a separate device for all crypto transactions. No personal apps, no Telegram, no browser extensions. - Encrypt your mnemonic phrase offline. Do not store it on any machine that connects to the internet. - Enable hardware wallet transaction signing. Do not use browser-based hot wallets for significant holdings. - Monitor your Telegram sessions regularly. Revoke unused sessions. - If you suspect compromise, move funds immediately to a new wallet created on a clean device.
The question is not whether this attack will happen again. It will. The question is whether you will be the victim.
