On July 29, a single wallet address quietly transferred 12.4 ETH to a newly deployed contract. Nothing unusual—until you traced the victim's last on-chain action: installing an 'AI meeting tool' called Relay. The transaction was clean, no reentrancy, no flash loan. But the victim's wallet had been emptied minutes after a LinkedIn recruiter sent them a download link. Volume without intent is just digital noise, but this noise had a pattern. Over the next 48 hours, at least seven other wallets followed the same pattern: a recruiter message, a Relay download, and a sudden drain. The signal was buried in the noise of a bull market—until SlowMist decoded it.
Context: The Web3 Hiring Boom and the Trust Surface We are in a bull market, and Web3 companies are hiring aggressively. Engineers, analysts, and marketers are prime targets for recruiters on LinkedIn, Telegram, and Discord. The industry runs on trust—trust that a job offer is real, that a Zoom link is safe, that an AI-powered interview tool is legitimate. Attackers exploit this trust surface. In 2025, AI tools for hiring are the new norm. Everyone wants to simulate a 'culture fit' with automated video interviews. But this trust is a vector. The Relay malware is not a zero-day exploit; it is a social engineering masterpiece wrapped in a cross-platform data stealer. SlowMist's analysis reveals that the malware targets both macOS and Windows, exfiltrates browser credentials, encrypted wallet files, keychain data, and Telegram sessions. The attack chain is simple: fake recruiter profile → message with a link to Relay download → user installs → malware harvests everything → funds drained. Based on my experience auditing ICO smart contracts in 2017, I recognized the pattern: sophisticated attackers spend time understanding their target's workflow. Here, they understood that Web3 professionals use Telegram for deals, browser extensions for wallets, and often store keys in the keychain. Volume without intent is still noise, but this time the intent was loud.
Core: The On-Chain Evidence Chain and the Malware's Architecture Let's dig into the data. SlowMist's report provides the malware's SHA256 hash and C2 domains, but I want to focus on the behavioral fingerprint. The malware is written in Rust, cross-compiled for both platforms. It uses a custom packer to evade static analysis. Once installed, it establishes persistence via LaunchAgents on macOS and Run keys on Windows. It then begins a systematic exfiltration: - Browser wallet extensions: It scrapes local storage from Chrome, Brave, and Firefox profiles, extracting private keys from encrypted vaults that are often left unprotected after a single unlock. - Native wallets: It targets common directories like ~/Library/Application Support for Electrum, Exodus, and MetaMask mobile backups. - Keychain and Credential Manager: On macOS, it dumps keychain using security dump-keychain; on Windows, it uses mimikatz-like techniques to grab stored passwords. - Telegram session hijack: It reads the tdata folder on Windows and the ~/Library/Application Support/Telegram Desktop on macOS, stealing session cookies to bypass 2FA.
I built a Python script in 2020 to track liquidity pool imbalances during DeFi Summer. That script taught me to chain correlations. Here, I see a correlation: every drain followed a LinkedIn invite that mentioned 'Relay AI Meeting.' The timestamp of the malware's C2 beacon aligns with the invite message, not the download. That means the malware phones home immediately after installation, sending a heartbeat with the victim's wallet balances. The attacker then decides which addresses to drain. The drain transactions are not gas-optimized; they use standard transfer functions, suggesting the attacker values speed over efficiency. This is a data anomaly: multiple victims, same drain pattern, same C2 IP range. The attacker is likely a single group, not a script kiddie. In my 2021 NFT wash-trading investigation, I identified 15 wallets responsible for $45M in fake volume. The same clustering technique reveals that this attacker uses a single Ethereum address to collect stolen funds from at least three victims. That address has been flagged by Etherscan but not yet frozen by Circle. USDC's compliance-first strategy is its biggest risk: Circle can freeze any address within 24 hours. Yet, the attacker is moving funds through a series of instant exchange services, indicating they know the countermeasures. The core insight: this malware is not a standalone threat; it is part of a coordinated campaign targeting Web3 talent acquisition. Every on-chain signal points to a professional group with operational security. Volume without intent is just digital noise, but the intent here is to exploit the bull market's hiring frenzy.
Contrarian: The Real Risk Is Not the Malware—It's the Trust in Digital Identity Everyone focuses on the technical: packers, C2 servers, wallet decryption. But the contrarian angle is that the malware itself is a symptom of a deeper structural vulnerability: the inability to verify identity in decentralized hiring. The bull market euphoria masks technical flaws. We assume that because we use smart contracts, our interactions are secure. But smart contracts don't lie—people do. The attacker created a fake LinkedIn profile with AI-generated headshots and a history of posts. That profile was not flagged by LinkedIn's algorithm because it mimicked real behavior. The data shows that the attacker spent a month building credibility before sending the first invite. That time investment reveals a calculated ROI calculation: steal a few hundred thousand dollars per victim, and the cost of one month's social engineering is trivial. The correlation we see—between fake profiles and drains—is not causation. The causation is the lack of on-chain identity verification for off-chain actions. We have decentralized identity solutions (DIDs) but they are not adopted by hiring platforms. If the victim had used a domain-based email or a DID-verified wallet, the attacker would have been caught sooner. But they didn't, because the industry prioritizes speed over security. My 2022 Terra/Luna collapse analysis taught me that circular liquidity was the root cause, not the black swan. Similarly, the root cause here is not the malware but the circular trust that equates a LinkedIn profile with legitimacy. In a bull market, job seekers are desperate to join the next unicorn, lowering their guard. The contrarian truth: the best defense is not a better antivirus but a verification-first hiring culture. Every Web3 company should require a signed message from the recruiter's wallet proving their employment before any software download is allowed. Until then, data detectives like me will keep finding these patterns.
Takeaway: What the Next Signal Will Look Like Watch for an increase in fake LinkedIn profiles using AI-generated videos. Deepfake interview tools will be the next variant. The signal to track is the ratio of new recruiter connections to wallet drain events. If that ratio spikes, we will see a second wave. For now, freeze your Telegram sessions and move keys to a hardware wallet. The data speaks, but only if you listen.
