The bytecode didn't lie. The people did.
On August 14, 2025, Singapore's police and Cyber Security Agency disclosed a breach that stole $11.8 million from a local crypto firm. The entry point? Not a smart contract bug. Not a flash loan. A fake job interview on Google Meet. The attacker impersonated a recruiter, conducted a video call with camera off, and convinced the victim to download a 'technical test' from a phishing site. That single download cascaded into a session token theft, a CI/CD pipeline compromise, and a wire transfer bypassing multi-signature approvals.
This isn't a story about code. It's about the gap between how we audit products and how we protect people.
Context: The Attack Chain as a Protocol
Let me disassemble the attack as if it were a smart contract. The attacker deployed a multi-stage attack vector that combined social engineering with technical supply chain exploitation. The stages, in order:
- Reconnaissance: LinkedIn scraping for crypto firm employees. The attacker targeted a specific company, likely a licensed exchange or custodian with a clear asset flow.
- Phishing: A fake email from a domain like
@company-careers.com. The attacker used a legitimate-looking job posting and a cloned recruiter profile.
- Trust Establishment: A Google Meet interview with the camera off. The attacker mimicked a real interview process, asking typical questions, then moved to the 'technical test' phase.
- Malware Delivery: The victim was directed to a fake website mimicking the company's tech stack. A 'coding test' required downloading a ZIP file containing a remote access trojan (RAT) or an information stealer.
- Credential Theft: The malware harvested session tokens from the victim's browser. These tokens bypassed the company's multi-factor authentication (MFA) because they were valid, active sessions.
- Lateral Movement: Using the stolen tokens, the attacker accessed the company's Bitbucket repository and CI/CD pipeline. They modified deployment scripts to inject a backdoor into the production environment.
- Asset Exfiltration: With elevated access, the attacker stole API keys and signed transactions that bypassed internal spending limits and approval workflows. $11.8 million in crypto assets exited the company's hot wallet.
The attack chain is a perfect loop: trust is the entry, code is the enabler, and process is the blind spot.
Core: The Code-Level Anatomy of Failure
I've spent years auditing smart contracts. But this attack didn't need a single Solidity vulnerability. It exploited three architectural weaknesses that are endemic to Web3 companies.
1. Session Token Over Trust
The most technically sophisticated part of this attack was the session token theft. The attacker used a RAT to extract the victim's browser cookies and session tokens. These tokens are the keys to the kingdom—they represent an authenticated session with the company's internal systems. Once stolen, the attacker could access Bitbucket, CI/CD, and the admin panel without triggering MFA.
Why? Because MFA is a one-time gate. Once the user passes it, the session token is the only proof of identity. If the token is not bound to a device IP or a hardware key, it can be replayed from any machine. This is a known vulnerability in OAuth 2.0 and session management, but most crypto companies treat MFA as a silver bullet.
2. CI/CD Pipeline Without Integrity Checks
The attacker modified the deployment pipeline. In a typical CI/CD setup, code is automatically built, tested, and deployed. If the pipeline itself is compromised, the attacker can inject malicious code into the production environment. There was no integrity check—no code signing, no manual approval for deployment changes. The pipeline trusted the user, and the user's token was stolen.
This is the equivalent of a smart contract upgrade without a timelock or multisig. The attack exploited the assumption that internal users are trustworthy.
3. Approval Workflow as a Single Point of Failure
The attacker used stolen credentials to bypass transaction limits. The company had a multi-signature approval process, but the attacker found a way to approve transactions using the stolen session tokens. This suggests that the approval system relied on the same authentication mechanism as the rest of the internal network. No independent verification, no hardware security module, no air-gapped signing.
In my 2022 audit of Lido's stETH withdrawal mechanism, I found a similar pattern: the DAO's liquidation process had a single point of failure in the latency of the multisig execution. Here, the failure is even simpler—the approval system was not isolated from the endpoint security.
We didn't need to find a reentrancy bug. We needed to find a people bug.
Contrarian: The Industry's False Sense of Security
The crypto industry spends billions on smart contract audits, formal verification, and bug bounties. Yet the biggest breaches in 2024 and 2025—the $1.5 billion Bybit hack, the $11.8 million Singapore job scam—did not exploit code vulnerabilities. They exploited operational security.
Here's the contrarian view: The industry is over-engineering on-chain security while under-investing in internal infrastructure.
Consider this: Every crypto company has a security team that audits smart contracts. How many have a dedicated endpoint detection and response (EDR) system? How many require hardware-bound session tokens for internal systems? How many conduct red-team exercises that simulate social engineering attacks?
In my experience as a Layer2 research lead, I've seen teams spend weeks optimizing gas costs for a single function, but they use the same password for GitHub and their email. The imbalance is structural.
The Singapore attack is a signal that the threat model has shifted. Attackers are no longer targeting the blockchain—they are targeting the humans who operate the blockchain. And the humans are the weakest link, not because they are careless, but because the systems they use are designed for convenience, not security.
Volatility is noise. Architecture is the signal. The architecture of internal security at most crypto companies is fragile. It's a house of cards built on trust, not on cryptographic proof.
Takeaway: The Vulnerability Forecast
This attack pattern is not a one-off. It's a playbook that will be replicated globally. The tools used—social engineering, session token theft, CI/CD manipulation—are well-known. The only novelty is the combination, and that combination is now public.
I predict three waves of consequences:
- Short-term (1-3 months): Imitators will target other crypto firms using the same script. Singapore's regulatory response will include mandatory security guidelines for hiring processes and endpoint protection.
- Medium-term (6-12 months): The industry will shift from 'smart contract audit' to 'full-stack security audit', including social engineering, endpoint security, and CI/CD integrity. Security firms will expand their services.
- Long-term (1-2 years): Regulators like MAS and the SEC will require proof of operational security maturity for licensing. 'Paper compliance' will no longer suffice.
For developers and operators: Audit your own internal processes. Ask yourself: 'If a determined attacker targets my company with a fake job offer, how many layers of defense do we have?' If the answer is less than three, you are the next target.
The $11.8 million interview is a lesson in humility. The code compiled. The trust didn't.
