# Social engineering and fake support · Drain Watch

15 incidents, 3 live. JSON: https://drains.watch/t/social-engineering.json · RSS: https://drains.watch/t/social-engineering/feed.xml

- [COLDCARD's X account posts fake 'security migration' phishing link](https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026) (live, Medium, Contained, since Oct 11, 2026)
- [Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets](https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026) (live, Critical, Still active, since Sep 18, 2026)
- [Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers](https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026) (closed, Medium, Contained, since Sep 9, 2026)
- [CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals](https://drains.watch/i/cow-swap-dns-hijack-apr-2026) (closed, Critical, Contained, since Apr 14, 2026)
- [Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions](https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026) (live, Critical, Contained, since Apr 1, 2026)
- [AI trading agent Lobstar Wilde sends about $250K in tokens to an X user who asked it for 4 SOL](https://drains.watch/i/lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026) (closed, High, Contained, since Feb 22, 2026)
- [IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine](https://drains.watch/i/iotex-iotube-bridge-key-compromise-feb-2026) (closed, Critical, Partly contained, since Feb 21, 2026)
- [North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech](https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026) (closed, Medium, Still active, since Feb 9, 2026)
- [North Korea-linked KONNI targets blockchain developers with an AI-generated PowerShell backdoor](https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026) (closed, Medium, Still active, since Jan 22, 2026)
- [Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam](https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026) (closed, Critical, Contained, since Jan 17, 2026)
- [Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks](https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025) (closed, Medium, Still active, since Oct 28, 2025)
- [THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend](https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025) (closed, Critical, Still active, since Sep 4, 2025)
- [YouTube 'MEV bot' tutorials, some AI-generated, tricked users into deploying drainer contracts; $900K+ taken](https://drains.watch/i/ai-video-mev-bot-tutorials-drainer-contracts-aug-2025) (closed, High, Still active, since Aug 5, 2025)
- [North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac](https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025) (closed, Medium, Still active, since Jun 11, 2025)
- [Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account](https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025) (closed, Medium, Still active, since May 13, 2025)