A Singapore-based crypto firm just lost $11.8 million to a recruitment scam that wasn't a scam—until the code executed. The attack vector? A fake job interview. The payload? Session token theft that bypassed MFA entirely. The exit? A modified CI/CD pipeline that shipped funds instead of features.
This isn't another phishing email. It's a surgical strike on the intersection of human trust and automated deployment. And it exposes a structural vulnerability that most Web3 companies haven't even mapped.
Context: Why This Attack Matters Now
We're in a bear market. Survival metrics dominate. Liquidity is scarce. In this environment, every security dollar spent on smart contract audits feels justified—until an attacker walks through the front door disguised as a candidate.
The attack, disclosed by Singapore police and the Cyber Security Agency on August 14, 2025, targeted a local crypto firm. The attackers posed as recruiters on LinkedIn, used fake domains like @company-careers.com, conducted Google Meet interviews with cameras off, and then directed victims to a fake website for a "technical test." The victim downloaded malware. The malware stole session tokens. The tokens bypassed MFA. The attackers accessed Bitbucket, modified CI/CD deployment scripts, gained remote access to internal servers, stole credentials, bypassed transaction limits, and transferred $11.8 million out.
This is not a zero-day exploit. It's a playbook.
Core: The Technical Breakdown
Let me dissect the attack chain from my perspective—I've spent years auditing smart contracts and building trading bots. The Hard Hat Protocol audit taught me that code integrity is the primary narrative driver. The Uniswap V2 dependency fix taught me that rebalancing strategies can be exploited. But this attack? It targets the people and processes that write the code.
Stage 1: Social Engineering Payload
The LinkedIn profile was fake. The email domain was spoofed. The interview was real enough to build trust. The camera-off tactic wasn't just anonymity—it forced the victim to accept the next step: downloading software for a coding test. This is classic social engineering, but with a twist: the attacker mimicked a full hiring pipeline, not just a one-off message.
Stage 2: Malware Delivery
The fake website hosted a malicious executable disguised as a coding test environment. The victim, eager to prove their skills, downloaded and ran it. This is the critical pivot point—the transition from human manipulation to technical compromise. Based on the attack pattern, the malware was likely a remote access trojan (RAT) or an information stealer designed to harvest session cookies.
Stage 3: Session Token Theft — The MFA Bypass
This is the most technically sophisticated part. The malware stole active session tokens from the victim's browser or authentication tool. These tokens, once stolen, allowed the attacker to impersonate the victim without triggering MFA. Why? Because MFA only validates at login. Session tokens are valid until expiry. This is a well-known blind spot in Web3 security: most firms deploy MFA but fail to implement continuous authentication or device binding.
I've seen this in my own work. During the NFT arbitrage bot build, I learned that latency isn't just about speed—it's about trust windows. A session token is a time-based trust. If you steal it, you own the window.
Stage 4: CI/CD Supply Chain Attack
With the victim's access, the attacker entered the code repository (likely Bitbucket). They modified the CI/CD pipeline to include malicious deployment instructions. This is a software supply chain attack: the automated deployment system, designed to push code to production, was repurposed to push credentials and access to the attacker.
Stage 5: Lateral Movement and Fund Transfer
The attacker used the compromised CI/CD to gain remote access to internal servers. They stole credentials that controlled transaction approval workflows. They bypassed limits and multi-signature checks. The $11.8 million moved out.
The Critical Insight: No Zero-Days Used
This entire attack uses known techniques: social engineering, malware, token theft, CI/CD abuse. There is no novel exploit. That's the terrifying part. The attack is highly replicable. It can be packaged into a playbook and sold on darknet forums. Every crypto firm with a hiring pipeline and a CI/CD system is a target.
Contrarian: The Unreported Angle — It's Not About the $11.8M
The media will focus on the loss amount. That's a mistake. The real story is the attack pattern's scalability. This isn't a one-off heist. It's a proof-of-concept for a new class of attacks targeting the operational security of Web3 companies.
Consider the asymmetry: The attacker spent weeks building fake profiles, conducting interviews, and customizing malware. The payoff was $11.8 million. But the playbook can be reused. The next target might be a DeFi protocol with $100 million in TVL. The cost of replication is near zero.
Moreover, the attack exploits a fundamental governance failure: Web3 firms audit their smart contracts but ignore their internal infrastructure. They spend $50,000 on a code audit but $0 on endpoint detection and response (EDR). They mandate MFA but don't enforce session token rotation. They hire security engineers for the blockchain layer but leave the CI/CD pipeline exposed.
I've seen this imbalance firsthand. The Terra Luna collapse post-mortem taught me that tokenomics flaws are often hidden in plain sight. But this attack isn't about tokenomics—it's about trust boundaries. The victim company allowed an external candidate (the attacker) to enter the internal trust boundary (company device, code repository, deployment system) without adequate controls. That's a governance failure, not a code failure.
Another Blind Spot: Session Token Lifetimes
Most Web3 companies issue session tokens with lifetimes of 30 to 90 days. The attacker, once inside, had months to explore, escalate, and exfiltrate. The market doesn't price this risk. Speed is the only metric that survives the crash—but in security, speed of detection matters more than speed of deployment.
Takeaway: What to Watch Next
This attack pattern will spread. Expect similar incidents targeting crypto firms in Hong Kong, Dubai, and the US within the next six months. The playbook is too profitable to ignore.
Regulators will respond. Singapore's MAS will likely issue new cybersecurity guidelines for licensed crypto firms, focusing on endpoint security and CI/CD integrity. The CSA may expand its definition of critical information infrastructure to include crypto exchanges. Compliance costs will rise.
But the real change must come from within. Every crypto firm should: - Implement session token binding to device fingerprints. - Enforce short-lived tokens (max 1 hour) with continuous re-authentication. - Deploy EDR on all company devices. - Require hardware security keys for CI/CD access. - Add manual approval gates for deployment changes. - Conduct red-team exercises that simulate social engineering attacks.
Floors are illusions until the bot sees the spread. In this market, the spread is between security theater and actual defense. The bot just saw the spread.
Speed is the only metric that survives the crash—but detection speed, not transaction speed. The $11.8 million was lost because the firm's detection latency was longer than the attacker's execution window. That's a metric you can't afford to ignore.