Last night, I got a LinkedIn message from a recruiter at a well-known protocol. The message was polished. The job description was perfect. The salary range? Above market. The equity? Generous. But something felt off. It wasn’t the pitch—it was the software they wanted me to install. ‘Just a quick AI meeting tool,’ they said. ‘It’s called Relay. It’s new. It’s built for Web3 teams.’ I didn’t click. I’m still holding my coins. But others did. And they lost everything.
I’ve been in this industry since the ICO hangover of 2017. I’ve seen phishing emails that mimic Coinbase support, fake airdrops that drain wallets, and Discord DMs with malicious links. But this one is different. This one targets the very moment we lower our guard—the job interview. And it’s not just a scam. It’s a fully weaponized, cross-platform info-stealer, designed by people who understand both crypto teams and human psychology. Trust is no longer a promise; it’s a protocol. And this attack breaks that protocol.
Context: The Perfect Trojan Horse
The attack was first documented by SlowMist on July 29, 2025. The playbook is simple yet devastating. Attackers pose as recruiters from legitimate crypto projects. They reach out via LinkedIn, Telegram, or email, often using cloned profiles of real employees. The conversation feels authentic—they ask about your experience, your preferred stack, your salary expectations. Then they send a link to download “Relay,” an AI-powered meeting scheduler that allegedly helps with interview logistics. The link leads to a website that looks professional. The download is smooth. But once installed, Relay is not a meeting tool. It’s a custom malicious executable that immediately begins harvesting sensitive data.
Based on my own experience building a crypto education platform and hiring over fifty people in the past three years, I can tell you that most teams rely on tools like Calendly, Notion, and Google Meet. We rarely ask candidates to install proprietary software before a first call. That’s a red flag. But the attackers bank on the excitement of a high-paying role. They bank on the fact that in Web3, we’re used to trying new tools. We trust the culture of innovation. And that trust becomes the attack surface.
Core: What Relay Steals and Why It’s Effective
SlowMist’s analysis reveals a multi-platform malware built in Rust or Go—both capable of cross-compilation to macOS and Windows. The sample they decompiled shows six distinct data-theft modules:
- Browser credential theft: Crawls Chrome, Firefox, Brave, and Edge for saved passwords and cookies.
- Crypto wallet extraction: Targets browser extension wallets (MetaMask, Phantom, Rabby, Keplr) as well as desktop wallets like Exodus and Electrum. It looks for key files and seed phrase backups stored in common directories.
- Keychain access (macOS): Uses system APIs to dump the user’s Keychain, where many store API keys, SSH keys, and encrypted wallet passwords.
- Telegram session hijacking: Steals the
tdatafolder—the same directory that contains your Telegram session. With that, an attacker can log in as you without needing a password or 2FA code. This is the scariest part because Telegram is the primary communication channel for most crypto teams. - Clipboard monitoring: Watches for copied crypto addresses and swaps them with the attacker’s address on the fly—classic clipboard hijacker.
- Screen capture and keylogging: Periodically takes screenshots and logs keystrokes to capture anything you type, including seed phrases you might be restoring.
The malware uses obfuscation techniques to avoid antivirus detection. It also checks for sandbox environments and virtual machines, refusing to run if it detects analysis tools. That’s a clear sign the attackers are sophisticated—likely not script kiddies. They know how security researchers operate and have built countermeasures.
Here’s the insight most people miss: This attack isn’t just about stealing your wallet. It’s about stealing your professional identity. Once they have your Telegram session, they can message your colleagues, your co-founders, your exchange support contacts. They can impersonate you to request withdrawals from team multi-sigs. They can read your private groups where investment opportunities are discussed. The total breach surface extends far beyond the individual victim. Code is law, but empathy is the interface. And right now, the interface is broken.
Contrarian: Hardware Wallets Are Not Enough
Every security article in crypto ends with the same advice: “Use a hardware wallet.” But this attack exposes a blind spot. Even if your private keys are on a Ledger, the scam still works. Here’s why:
- Hardware wallets protect on-chain signatures, but they don’t protect your browser session. The malware can steal your MetaMask extension’s password and the encrypted seed behind it—even if you only store that seed on hardware? No, many users still keep a mnemonic backup on their computer “just in case.” The malware finds that.
- Telegram session hijacking gives the attacker access to your team’s internal chats. They can see your exchange API keys if you ever pasted one. They can read your recent transaction history and guess where your funds are.
- Clipboard hijacking works even with hardware wallets. If you copy an address from your Ledger Live app and paste it into a browser, the malware swaps it. You don’t notice until the transaction is confirmed.
The contrarian truth is that the core vulnerability is not code—it’s convenience. We’ve built an ecosystem that prioritizes speed and low friction over security. We link our Telegram to our exchange accounts. We keep passwords in our browser. We trust that a LinkedIn profile with 500+ connections is real. The attackers know this better than we do.
I learned to stop preaching and start listening. After the 2022 bear market burnout, I spent months talking to victims of social engineering. The common thread was always the same: they knew the best practices, but they made an exception “just this once.” Just this one time I’ll install a closed-source tool for a job interview. Just this one time I’ll approve a blind contract interaction. The attackers are not breaking cryptography—they’re breaking habits.
Takeaway: Survival Requires a New Trust Model
This is not a problem that can be solved with better antivirus software or a hardware wallet. The solution is behavioral, and it requires a shift in how we approach professional interactions in Web3.
First, never install software for a first interview. If a recruiter asks you to download a tool before you’ve even spoken, that’s a 100% red flag. Legitimate teams use video conferencing platforms that run in your browser. If they need a meeting scheduler, they send a Calendly link—not a .dmg or .exe.
Second, treat every job offer as a potential attack. Verify the recruiter’s identity through multiple channels. Call the company’s HR phone number (yes, most have one). Check if the role is posted on their official careers page. Use decentralized identity systems like ENS or Spruce ID to confirm domain ownership.
Third, operate in a security sandbox. For anyone actively job hunting, set up a dedicated computer with no wallets, no Telegram, and no saved passwords. Use a freshly installed OS for interview-related software. This is inconvenient, but so is losing your life savings.
I’m not writing this to spread fear. I’m writing this because I believe Web3 can be better. We didn’t build this industry to trust strangers with our wallets. We built it to create systems where trust is verifiable, not assumed. And that starts with how we interact—even before the first paycheck.