Social engineering and fake support
Someone posing as support, a recruiter, a journalist or a friend talks you into revealing a seed phrase, installing malware or signing something.
How it works
Fake support agents reply to complaints on X and in Discord, then move you to a 'help desk' that asks for your seed phrase.
Fake recruiters and podcast hosts send a 'meeting app' or coding test that installs key-stealing malware; state-backed groups have used this against crypto teams.
Compromised friends' accounts ask for a quick transfer or a vote on a site.
Red flags
- Support that contacts you first
- Anyone asking for a seed phrase, for any reason
- Interview or meeting software you have to download from a link
Protect yourself
- Real support never asks for your seed phrase
- Join calls from the browser or known apps only
- Confirm unusual requests from friends through another channel
If you already signed
- Move funds to a new wallet with a fresh seed phrase on a clean device
- Scan or wipe any machine that ran the downloaded software
Incidents using it 11
-
Medium✓Contained
COLDCARD's X account posts fake 'security migration' phishing link
On 11 October 2026 the official X account of hardware wallet maker COLDCARD published an unauthorized post claiming a flaw in recovery phrase generation in newer firmware and urging users to move their Bitcoin through a 'security migration' site that impersonated COLDCARD. The company deleted the post, said it was investigating how it was published, and said it found no matching login or session record despite offline 2FA. No losses were confirmed. The only official site is coldcard.com; never enter a seed phrase on any website.
COLDCARD hardware wallet users on X·Bitcoin·Since Oct 11, 2026·
-
Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets
On 18 September 2026 Japanese, US, Australian and German authorities warned that the North Korean group WaterPlum, linked to the 'Contagious Interview' campaign, infected at least 30,000 devices in more than 100 countries between December 2025 and July 2026. Posing as AI, crypto or NFT firms and recruiters, they get targets to run code during fake interviews and coding tests, including malicious npm packages and VS Code projects, then steal private keys, seed phrases and passwords. Funds or credentials were taken from over 7,000 wallets, and more than 1.7 billion yen (about $10.71M) went to North Korea. The advisory does not say the campaign has stopped.
Crypto, AI and NFT developers and job seekers·Multiple EVM chains·$11M stolen·Since Sep 18, 2026·
-
Medium✓Contained
Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers
An attacker abused an authorization flaw in email platform Brevo to reach 138 client accounts and send phishing from six of them. One was a fake Trezor 'Critical Security Alert: STM32 Entropy Vulnerability' sent to about 347,000 Trezor newsletter subscribers, linking to an app that asked for wallet backups; BitBox's list and CoinTracking (a fake 'refresh API keys' email) were also used. Trezor took the phishing domain down within 20 minutes; about 2,500 people opened the link and no losses have been reported. Recipients should expect follow-up phishing to the same addresses.
Trezor, BitBox and CoinTracking newsletter subscribers·Bitcoin, Multiple EVM chains·Since Sep 9, 2026·
-
North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech
Mandiant reported on 9 February 2026 an intrusion at a crypto-sector fintech that began with a message from a crypto executive's hijacked Telegram account and a Calendly invite to a spoofed Zoom meeting. On the call the victim saw what appeared to be a deepfake of another crypto company's CEO, was told their audio was broken and was talked into running 'troubleshooting' commands (ClickFix). Those commands installed seven malware families on macOS that collect credentials, browser and Telegram data to enable crypto theft. Mandiant tied it to the North Korea-linked group UNC1069 and reported no stolen amount.
Crypto and DeFi fintech staff on macOS·Multiple EVM chains·Since Feb 9, 2026·
-
North Korea-linked KONNI targets blockchain developers with an AI-generated PowerShell backdoor
Check Point Research reported on 22 January 2026 that the North Korea-linked group KONNI, long focused on South Korean government targets, is now going after developers and engineering teams on blockchain and crypto projects. Phishing lures dressed up as project documentation deliver a PowerShell backdoor that Check Point calls AI-generated, with activity seen in Japan, Australia and India. A compromised developer can expose source code, infrastructure and blockchain credentials. No losses were reported.
Blockchain and crypto developers and engineering teams (Asia-Pacific)·Multiple EVM chains·Since Jan 22, 2026·
-
Critical✓Contained
Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam
On Jan 17, 2026, the Solana DEX Meteora sent $1.5 million in USDC to what it believed was a trusted escrow wallet for an OTC buyback of its MET token. Scammers had impersonated the seller to Meteora and Meteora to the seller, so the 'escrow' address was theirs. The funds were reportedly moved through KuCoin. No smart contract was exploited and no user funds were involved. Meteora disclosed the loss in its Q1 2026 token holder report. Teams doing OTC deals should confirm counterparties and escrow addresses over a separate, known channel.
Meteora treasury (OTC buyback of MET)·Solana·$1.5M stolen·Since Jan 17, 2026·
-
Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks
Kaspersky disclosed on 28 October 2025 two BlueNoroff campaigns aimed at Web3 and crypto organisations in India, Turkey, Australia and other countries in Europe and Asia, active since at least April 2025. GhostCall reaches executives and founders on Telegram with fake investor meetings, where an 'audio fix' installs malware; GhostHire sends blockchain developers fake job tests in GitHub repositories that hide malware. Kaspersky says generative AI has helped the group develop malware faster, and the payloads include crypto stealers. No loss figures were given.
Web3 and crypto executives, founders and blockchain developers·Multiple EVM chains·Since Oct 28, 2025·
-
THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend
In early September 2025 THORChain co-founder John-Paul Thorbjornsen got a Zoom link from a friend's hacked Telegram account, joined in his browser and, by his account, saw a deepfake of his friend with no sound before leaving. An old MetaMask wallet of his was later drained of about $1.35M in Kyber Network and THORSwap tokens (PeckShield valued it at about $1.2M); he believes the key was reached through iCloud Keychain or a zero-day. ZachXBT attributed the theft to North Korean hackers, and THORChain said the protocol itself was not affected.
THORChain co-founder's personal wallet·Ethereum·$1.4M stolen·Since Sep 4, 2025·
-
YouTube 'MEV bot' tutorials, some AI-generated, tricked users into deploying drainer contracts; $900K+ taken
SentinelLABS reported in August 2025 that scammers use YouTube tutorials to get people to deploy a 'free' Ethereum arbitrage bot contract through Remix, fund it with ETH and press Start. Hidden code sends the ETH to an attacker wallet, and the top attacker address alone received 244.9 ETH (about $902,000). The videos ran on aged channels with manipulated comments, and SentinelLABS says several appear to be AI-generated. Versions of the scam have run since at least early 2024 and were described as ongoing.
Ethereum users following YouTube 'MEV bot' tutorials·Ethereum·$900K stolen·Since Aug 5, 2025·
-
North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac
Huntress reported on 18 June 2025 that an employee of a cryptocurrency foundation was contacted on Telegram, sent a Calendly invite and led to a fake Zoom domain. Weeks later the employee joined a group call that contained several deepfakes of the company's senior leadership; when 'audio problems' came up, they were told to install a Zoom extension that was really a malicious AppleScript. It installed a set of macOS backdoors, a keylogger and screen recorder, and a crypto-wallet stealer called CryptoBot. Huntress did not say whether funds were stolen.
Crypto foundation staff on macOS·Multiple EVM chains·Since Jun 11, 2025·
-
Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account
On 13 May 2025 Polygon co-founder Sandeep Nailwal warned that attackers had taken over the Telegram account of the head of Polygon Ventures and were messaging startup founders in its network. Targets were invited to Zoom calls showing AI-generated video of Nailwal and other team members with no audio, and were urged to install an 'SDK' to fix the sound, which would infect their computers. No losses were reported. Do not install software during a call, even when the people on screen look like contacts you know.
Startup founders in Polygon's investment network·Multiple EVM chains·Since May 13, 2025·