The $11.8 million loss from a Singapore crypto firm made headlines. But the real story isn't the money—it's the attack pattern.
Context
Channel News Asia reported on August 14, 2025, that Singapore police and the Cyber Security Agency disclosed a sophisticated recruitment scam targeting a crypto company. Attackers posed as recruiters on LinkedIn, conducted fake Google Meet interviews (cameras off), then asked victims to download a “technical test” from a spoofed website. That payload was malware.
Once inside the employee’s device, they stole session tokens, bypassed MFA, accessed the company’s Bitbucket repositories, modified CI/CD deployment scripts, and ultimately siphoned $11.8M in crypto assets by abusing internal approval flows.
Core
This is not your average phishing campaign. It’s a multi-stage supply chain attack that weaponizes the hiring process. The technical brilliance lies not in zero-days, but in the orchestration of known techniques: social engineering, session hijacking, and CI/CD manipulation.
The session token theft is the linchpin. Most Web3 companies deploy MFA and feel secure. But MFA only protects the login step. Once a session token is stolen, the attacker can impersonate the user indefinitely—no prompts, no alerts. In this case, the token gave them access to code repositories and internal systems.
From there, modifying the CI/CD pipeline was trivial. The attacker altered automated deployment instructions to inject backdoors or redirect funds. The internal approval system, which relied on static credentials, was bypassed because the attacker already had privileged access.
This attack is replicable. The playbook uses publicly available tools and techniques. No zero-day required. Every crypto company with a hiring process and a CI/CD pipeline is a potential target.
Contrarian
The industry’s obsession with smart contract auditing is misplaced. We spend millions verifying code, but leave the doors unlocked. This attack didn’t exploit a single line of on-chain logic. It exploited the gap between “human trust” and “machine trust.”
Most teams think security is about the blockchain. It’s not. It’s about the endpoints, the session management, the CI/CD integrity, and the process of onboarding people. The attacker didn’t need to break the protocol—they just needed to break the employee.
Pain is just data you haven’t decoded yet. The pain here is a clear signal: the weakest link is the operational layer.
Takeaway
If you run a Web3 team, ask yourself: Can a stolen session token give access to your deployment pipeline? Do you have device trust policies? Is your CI/CD pipeline integrity-checked?
The candlestick doesn’t lie, but your bias might. The bias that “smart contract audit equals security” is the lie. This case is a wake-up call. The next attack will use the same playbook. Are you ready?