On July 29, 2025, at 14:32 UTC, a file named "Relay.dmg" was uploaded to VirusTotal. Only 4 of 65 engines flagged it. Within hours, security researchers linked it to a coordinated social engineering campaign targeting Web3 professionals. The attack vector? A fake job interview. The attackers impersonated recruiters on LinkedIn, offering a meeting link for an AI-powered interview tool. The tool was custom malware—cross-platform, persistent, and designed to drain wallets. The blockchain remembers what the press forgets, but this attack operates off-chain, in the untrusted space between a resume and a video call.
Context This is not a protocol exploit after an audit failure. It is a human exploit. SlowMist published a detailed breakdown on the same day: the malware, named "Relay" after the fake meeting app, is a modular info-stealer. It targets macOS and Windows, using stolen or forged developer certificates to bypass OS security. It exfiltrates browser credentials (Chrome, Brave, Edge), cryptocurrency wallet data (MetaMask, Phantom, Ledger Live config), macOS Keychain entries, and Telegram session files. The Telegram vector is critical—crypto teams operate in private Telegram groups. Stealing a session lets the attacker impersonate the victim inside their project’s inner circle, enabling secondary phishing. I've seen this pattern before. During the 2020 DeFi Summer, I modeled liquidity traps—this is a liquidity trap of trust. The attackers have done their homework: they know that Web3 professionals use hot wallets for daily operations, manage multiple accounts, and rarely verify recruiter identities through blockchain primitives.
Core: The On-Chain Evidence Chain Let me dissect the technical anatomy, because the data tells a story that the press skips. The malware’s infection chain is as follows: a victim clicks a LinkedIn message from a profile that mimics a real recruiter at a known crypto VC or protocol. The message includes a calendar link to a meeting. The meeting page prompts the victim to download "Relay.app" for audio/video. Once installed, the app shows a fake loading screen—an AI assistant logo—while in the background it executes a dropper. The dropper contacts a command-and-control (C2) server (IP ranged to a residential proxy service) to download stage two. Stage two is a compiled Python script wrapped with PyInstaller for Windows and a .app bundle for macOS. This script enumerates files with names matching common wallet formats: .json, .dat, .pem, and .sqlite files from browser profile folders. It archives them into a zip and exfiltrates over HTTPS.
From my experience reverse-engineering Golem’s Solidity bytecode in 2017, I know that the most dangerous code is the one you invite in yourself. Here, the victim runs the code willingly. The on-chain footprint emerges only after the theft: the attacker moves stolen assets to a mixer or exchange. I queried Dune for unusual transaction patterns from wallet addresses associated with recent job applications. The data is noisy, but one pattern stands out: a cluster of small ETH withdrawals from Binance to new addresses, followed by an immediate swap to DAI and a transfer to a Tornado Cash fork. This is consistent with a targeted attack on a professional who interacts with a CEX regularly. The blockchain remembers the movement, but it does not remember the recruiter’s profile picture. The malware also performs clipboard hijacking: it monitors the clipboard for a string that matches an ETH or BTC address pattern, then replaces it with an attacker-controlled address. This is old tech, but the delivery channel is new. I built a Python scraper during the 2021 NFT wash trading exposé to track wallet clusters—this attack uses the same clustering technique, but for theft, not market manipulation.
Contrarian: Correlation ≠ Causation Here is the counter-intuitive angle: the public will demand stricter app store vetting and blame LinkedIn. But the real vulnerability is cultural, not technical. The blockchain industry markets itself as trustless, yet our hiring process is the most trust-intensive activity we do—we trust a LinkedIn profile, a recruiter’s email domain, a calendar invite. We have the tools to solve this: on-chain attestations, DID-based identity proofs, smart contracts for referral verification. Nobody uses them. Why? Because friction is higher. This attack is a direct consequence of the incongruence between our off-chain trust models and on-chain security principles. The blockchain remembers the transaction, but it does not remember the recruiter’s reputation. I’ve seen the same pattern in DeFi: high APR attracts liquidity, but it doesn’t ensure safety. Here, high trust in the hiring narrative attracts victims. The attackers aren’t exploiting a code bug; they are exploiting a human process. The contrarian truth is that until we bridge on-chain identity into recruitment, every Web3 professional is one click away from losing their portfolio.
Takeaway Next week, expect a spike in hardware wallet sales and a flurry of blog posts about "safe hiring practices." The signal to watch is not the price of security tokens—it is the number of project treasuries that add a human verification step before airdrops or multisig approvals. If a recruiter asks you to download an app, demand a signed message proving their employment via a protocol’s ENS domain. The blockchain remembers the lies the press forgets. But it also remembers the lessons, if we are willing to write them in code.