Fake crypto job offer leads to $11.8 million corporate heist

The Singapore Police Force and the Cyber Security Agency of Singapore reported that the scheme began on LinkedIn, where attackers posed as recruiters. The victim was lured into a series of video interviews and eventually directed to a spoofed website to complete a technical assessment. During this assessment, the employee unwittingly installed malware on a company-issued device, which allowed the attackers to harvest a session token.

By bypassing multi-factor authentication using the stolen token, the intruders gained access to the company’s Bitbucket repository. Once inside, they modified automated software deployment instructions to pivot into the firm's internal servers. The stolen credentials enabled the attackers to override transaction limits and approval protocols, facilitating the unauthorized transfer of funds. Authorities are now urging firms to bolster security for code repositories and deployment pipelines, noting that recruitment-based social engineering remains a persistent threat to the cryptocurrency and technology sectors.