Hook

It’s 10 AM. You’re a DeFi developer at a top protocol. A LinkedIn message lands from a recruiter at a well-known crypto fund. They want to schedule a technical screen using a new AI-powered meeting tool called “Relay.” You download it, run the installer, and five minutes later your entire digital life is gone. Private keys, Telegram sessions, browser cookies—all siphoned to a command server in a jurisdiction that doesn’t extradite. This isn’t a hypothetical. It happened this week. SlowMist just published the full sample analysis. And the attacker didn’t need to exploit a smart contract vulnerability or compromise a bridge. They just needed you to trust the wrong link.

Chasing alpha through the 2017 hallucination taught me that the most dangerous attacks don’t exploit code—they exploit psychology.

Context

The crypto hiring market is white-hot in mid-2025. Every week, thousands of Web3 professionals interview for roles at protocols, exchanges, and DAOs. The standard workflow: a recruiter reaches out, you share a GitHub/portfolio, they send a calendar invite with a link to a video platform. AI-transcription and AI-meeting tools have become ubiquitous—think Otter.ai, Fireflies, or dedicated crypto-native platforms like “Sovereign Meet.” The attacker piggybacked on this exact pattern. They created a fake company website, a convincing LinkedIn profile with mutual connections (likely scraped from past victims), and a custom-built information stealer named after a legitimate-sounding app: “Relay.”

The precision is what caught my attention. This was not a broad spray of phishing emails. Each target was personally vetted. The attacker knew the target’s role, their current employer, and the specific projects they worked on. This suggests either a compromised recruiter’s database or a dedicated intelligence-gathering phase. Either way, the initial hook—a job interview—is nearly impossible to reject without appearing unprofessional.

I’ve been filtering signal from the ICO noise since 2017, and I’ve seen social engineering evolve from simple “send me ETH” DMs to complex multi-stage operations. But this one merges two powerful trends: the AI hype cycle and the desperate talent war in crypto. The attacker sells a narrative of opportunity. You want the job, so you lower your guard.

Core: The Malware Breakdown

Based on the SlowMist disclosure (which I independently verified against the sample hashes they posted), here is the technical anatomy of the attack:

• Delivery: The target receives a direct message (LinkedIn, Telegram, or email) from a fake recruiter account. They are asked to download “Relay” from a domain that mimics a legitimate meeting platform. The domain was registered three days before the first reported incident—classic short-lived infrastructure.
• Payload: The installer is a signed executable on Windows and a signed .dmg on macOS. Both contain a legitimate-looking Electron wrapper that shows a loading screen (“Connecting to AI meeting room…”) while the malware deploys in the background. The signatures were created using stolen developer certificates—a sign of a resourceful operator.
• Exfiltration: Once installed, the malware executes a multi-threaded data harvester. It targets:
• Browser credential databases (Chrome, Brave, Firefox, Arc) to steal saved passwords and cookies.
• Cryptocurrency wallet extensions: MetaMask, Phantom, Rabby, Keplr, and at least a dozen others. It reads the extension’s local storage files to extract private keys and mnemonic phrases.
• macOS Keychain and Windows Credential Manager to harvest stored API tokens and exchange 2FA seeds.
• Telegram session files—this is critical because Telegram desktop stores the session token locally. With that token, the attacker can impersonate the victim entirely, bypassing SMS or app-based 2FA.
• Persistence: The malware installs a launch agent (macOS) or scheduled task (Windows) that re-executes on reboot. It also attempts to disable macOS Gatekeeper and Windows Defender by modifying registry keys and plist files.
• C2: Data is sent over HTTPS to an API endpoint hosted on a compromised VPS. The traffic is encrypted with standard TLS. No custom protocol—blends in with normal web traffic.

Uniswap taught me liquidity is truth; this attack taught me that trust is the weakest oracle.

Wait, there’s more. The malware includes a module that monitors the clipboard in real-time. If the victim copies a cryptocurrency address, the malware replaces it with an attacker-controlled address. This is a direct attack on the user’s transactional integrity—even if you use a hardware wallet for signing, you might paste the wrong address.

What makes this particularly insidious is the session hijacking angle. Even if you keep your private keys on a Ledger, the attacker can now use your authenticated Telegram session to message your team members, access group channels, and request trades or transfers. The contagion risk is high. One compromised developer could lead to a faked emergency request on a protocol’s internal Telegram, triggering a multi-million-dollar exploit.

From the sample, I extracted the list of targeted wallet extensions. The attacker did not discriminate—they included every major EVM wallet, Solana wallets (Phantom, Solflare), and even non-custodial exchanges like Binance Web3. This suggests the attacker is agnostic to chain; they just want the seed phrase.

Entropy in the blockchain is real, but entropy in a human brain is predictable.

The SlowMist team also noted that the malware checks for virtual machine environments (VMware, VirtualBox) and terminates itself if detected. This means running the “Relay” installer on a work laptop inside a VM—a common security practice—would not have triggered the payload. But many professionals bypass this because they want the interview to be smooth, without technical hiccups. The attacker correctly bet that users would not sandbox their main machine for a job interview.

Contrarian: The Real Blind Spot

The immediate instinct after reading this is to say: “Always use a hardware wallet, don’t store keys on your computer.” That advice is stale. The attacker isn’t after your Ledger—they’re after your session.

Consider this: A Web3 professional who uses a hardware wallet for signing but keeps their Telegram logged in on their laptop is still catastrophically vulnerable. The attacker can spoof messages to colleagues, join private discord servers using stolen tokens, and even reset passwords for exchange accounts that rely on email-only recovery—because they also stole the email session cookie.

The contrarian angle I want to stress is that the crypto security industry has spent years focusing on on-chain threats: reentrancy, price oracle manipulation, flash loan attacks. But the most profitable hacks in 2025 are increasingly off-chain. They target the human layer. And the human layer is not protected by formal verification audits or bug bounties.

Moreover, the attack reveals a gap in the recruitment process itself. No major Web3 hiring platform has implemented a mandatory identity verification for recruiters. LinkedIn’s verification system is opt-in and rarely used. The attacker exploited this void. The market is underestimating the cost of fake-recruiter attacks. Every major protocol should now mandate that all interview invitations come through an authenticated platform (like a DID-based portal) or at least require a signed message from the recruiter’s verified ENS address.

Also, the narrative of “AI interview tools” is only going to deepen. In the next six months, I expect to see clones of this campaign using actual AI-generated voice clones for fake Zoom interviews, or deepfake video to make the recruiter look and sound like a real person. The current attack is the dry run. The full-scale invasion comes next.

Surviving the Terra algorithmic trap taught me that when everyone trusts a mechanism, that’s when the mechanism breaks.

Takeaway

This is not FUD. This is a technical warning with actionable mitigations.

• Immediate action: If you are a Web3 professional, do not install any third-party meeting application from an unsolicited recruiter link. Insist on using a mainstream platform (Zoom, Google Meet) or a known crypto-native tool like Warp.
• For protocols: Create a verified channel for recruitment. Use ENS or a social verification badge. Share this SlowMist report with your team. Consider adopting a zero-trust interview workflow: the candidate uses a temporary VM or a dedicated device for the interview, with no access to their real wallets or keys.
• For the industry: Treat session tokens as the new private keys. They should be rotated frequently. Telegram sessions should use a self-destructing TTL. Browser profiles for work should be separated from personal use.

Curating chaos for clarity is what I do. This week’s clarity: the smart contract never lies, but the person behind the avatar often does.

The next major crypto hack won’t be a $100 million bridge exploit. It will be a $100 million collection of stolen seed phrases collected through fake interviews. The attacker has already built the tool. Now they’re scaling the targeting. The question is: will you sandbox your next interview?