Mankun Criminal Defense | New Web3 Recruitment Scam: How Does an Online Interview Become a Gateway to Wallet Theft?

What truly merits attention in this kind of incident is not only how to identify malicious software, but the most practical legal questions for victims:

The software was installed by the victim's own click, and the wallet was also self-custodied; after the assets are transferred away, can a criminal case still be reported? With only device logs and on-chain transaction records, how can one prove that one's crypto was stolen by a Trojan?

Such attacks usually do not directly send a crude phishing link; instead, they first build trust through recruitment, investment discussions, project cooperation or online meetings.

Attackers may proactively contact targets on LinkedIn, Telegram,Discordor X, using the names of real projects, misappropriating team members' profile pictures, and even creating official websites, white papers and code repositories. After communicating for a period of time, the other party asks the target to install an unfamiliar application on the pretext of an "internal meeting tool", an "AI interview system" or a "technical testing environment".

Once the malicious program runs, it may collect account credentials and passwords saved in the browser, cookies, Telegram sessions, system Keychain data and wallet plugin information; if private keys or mnemonic files are stored on the device, or the wallet is in a logged-in state, the attacker may further obtain control over the assets. The fake Zoom and fake conferencing software attacks previously analyzed by SlowMist also exhibited a complete chain in which users were induced to enter their system passwords, browser and wallet data were collected, and the data was then sent to the attacker's server.

This type of attack particularly targets Web3 practitioners because their work computers often simultaneously hold project email accounts, Telegram, exchange accounts, wallet plugins, cloud service permissions and code repositories. What the attacker obtains may be not only personal wallets, but also project backends, official social media accounts or evenmultisignaturepermissions.

Many victims worry: "I clicked the link myself, and I actively granted the installation permission. Will the police think it was my own operational mistake?"

However, it is necessary to distinguish between two entirely different kinds of "consent".

What the job applicant consented to install was a conferencing software for online interviews; the applicant did not consent to the other party secretly reading system data, stealing wallet credentials, and certainly did not consent to the other party transferring the applicant's digital assets.

Voluntarily installing software does not amount to authorizing an attacker to steal data and dispose of assets.

Guiding Case No. 27 of the Supreme People's Court expressly distinguishes online fraud from online theft: if the perpetrator induces the victim to click a link but actually, through a pre-implanted computer program, secretly transfers property without the victim having any awareness of disposing of it, the primary means still constitutes secret taking and may be evaluated as the crime of theft; if the victim, due to a false transaction or false service, forms a mistaken understanding and actively completes the delivery of property, the conduct is closer to fraud.

Therefore, in the context of fake recruitment software, recruitment pitches are usually merely a means of implanting Trojans. If wallet assets are secretly transferred without the victim's knowledge, the legal assessment differs from that of the victim voluntarily transferring USDT to the "recruiter."

Such cases may simultaneously involve social deception, malicious programs, and the transfer of virtual assets, and cannot simply be uniformly labeled recruitment fraud on the basis that "the other party impersonated a recruiter."

The judicial interpretation of the Supreme People's Court and the Supreme People's Procuratorate on crimes endangering the security of computer information systems includes data used to confirm operational authority, such as account names, passphrases, passwords, and digital certificates, within the scope of identity authentication information, and sets corresponding criminalization standards for illegally obtaining data, illegally controlling systems, and providing specialized programs or tools.

In cases involving the use of hacking techniques to intrude into systems and transfer virtual assets, judicial practice has also evaluated such conduct through different paths, such as theft and the crime of illegally obtaining computer information system data, and the final determination needs to be made in light of the target of the attack, the technical means, and the asset transfer process. In a case publicly disclosed by the Supreme People's Procuratorate, the perpetrator intruded into a platform, obtained wallet addresses and transaction passwords, and transferred virtual assets, and was approved for arrest on suspicion of the crime of illegally obtaining computer information system data.

Therefore, when reporting to the police, victims do not need to insist on a particular charge themselves; the key is to clearly explain the complete process of the recruitment scam, the running of the software, the data leakage, and the on-chain transfers.

A transaction hash can prove that assets were transferred from one address to another, but it cannot by itself prove who originally controlled the wallet, how the attacker obtained authorization, or whether the transfer was carried out by the victim personally.

It is advisable to simultaneously organize the following six chains of evidence:

When public security authorities handle criminal cases, electronic data may serve as statutory evidence, but it must be verified as authentic. Therefore, original devices, original chat accounts, and complete backend records generally have greater probative value than screenshots that have been forwarded and cropped multiple times.

After discovering that a wallet has been compromised, do not immediately format the computer, uninstall software, or clear chat records. These actions may destroy malicious files, operation logs, and network connection records, making it impossible to reconstruct the attack path later.

The answer is not an either-or choice; rather, "security containment" and "preservation of the scene" should be accomplished at the same time.

First, you should immediately stop entering passwords, connecting wallets, or making new transfers on the infected device. If the device is still connected to the internet, you may disconnect the network first, but do not repeatedly power the device on and off, reinstall the system, or clean up files without technical judgment.

Subsequently, use a device confirmed to be secure to check wallets, exchanges, email accounts, and social media accounts. For high-risk wallets that remain controllable, you should promptly transfer remaining assets, revoke abnormal authorizations, and change the passwords and two-factor authentication settings of the relevant accounts in accordance with the asset status.

At the same time, you should preserve the malicious installation package, download page, chat records, system prompts, and abnormal transaction information, and contact a security institution as soon as possible for device forensics and on-chain tracing. If the stolen assets have already entered a centralized exchange, you may also promptly submit the addresses, transaction hashes, police report evidence, and ownership documentation to the platform's risk management department.

The security handbook published by SlowMist likewise recommends that, after a device is infected, priority should be given to protecting remaining assets and changing important accounts and two-factor authentication, while also preserving the scene and retaining virus files, devices, and logs to avoid key evidence being cleaned up.

If an employee installs malicious software during business negotiations or job application communications, causing the company's Telegram, project email, cloud server, or wallet permissions to be leaked, liability cannot simply be handled on the basis of "whoever clicked bears responsibility."

It is necessary to further examine whether the company allowed employees to install software on their own, why high-privilege credentials were stored on the device, whether the project adopted multisignature and hardware wallets, whether private keys were isolated from the daily office environment, and whether the company had long-standing management vulnerabilities such as shared accounts and sending passwords in plain text.

If the employee merely installed highly disguised software by mistake due to ordinary negligence, and the company lacked security training, a software whitelist, and a permission isolation system, it may not be reasonable to require the employee to bear all losses. Conversely, if the employee had already received clear security warnings but still violated rules by disabling protections, providing mnemonic phrases to strangers, or even deleting logs and concealing facts after the incident, their personal liability may be significantly increased.

For the project party, the most important thing after an incident is not to find an employee to "take the blame" at the first opportunity, but to immediately secure evidence concerning devices, accounts, wallets, and internal communications, and to distinguish between external Trojan attacks, insider operations, and permission management defects.

For individual victims, lawyers can assist in organizing four timelines—recruitment communications, malware, device anomalies, and on-chain funds—to prepare reporting materials and an evidence index; at the same time, based on the flow of assets, they can coordinate with security firms to compile the addresses, transaction hashes, and ownership materials required for exchange assistance.

For project teams, legal involvement typically goes beyond drafting a report and includes coordinating electronic data preservation, employee interviews, internal access reviews, and confirmation of the scope of loss, so as to avoid impairing subsequent investigation—before the attack path has been clarified—through deletion of device data, incorrect external attribution, or inaccurate public statements.

If the software installed by the victim remains on the device, or the stolen assets are still being transferred, legal handling and security response should proceed in parallel. On-chain tracing alone without securing offline identity and device evidence, or merely filing a report without being able to provide attack samples and asset paths, may reduce the efficiency of subsequent investigation.

The danger of fake Web3 recruitment lies in the fact that attackers exploit not an obvious “investment scam,” but practitioners’ ordinary need for job opportunities, remote collaboration, and new tools.

The fact that a job seeker voluntarily installed software does not mean they consented to the reading of wallet credentials, still less that they must bear the loss alone after their assets are stolen.

Whether such cases can be effectively reported and traced depends on whether four things can be proven: the recruitment identity was fictitious, the software had malicious functions, device permissions were thereby unlawfully obtained, and the wallet assets were subsequently transferred without the person’s knowledge.

After discovering anomalies, losses should be stopped as quickly as possible, but do not “clean up the scene” by deleting software or reinstalling the system. In an environment where on-chain assets are irreversible, speed of action matters; yet device logs, malicious samples, and complete chat records often determine whether the attack can ultimately be reconstructed from a “wallet inexplicably emptied” into an investigable criminal evidence chain.

/ END.

*This article is an original article of Mankun Law Firm and represents only the personal views of the author. It does not constitute legal consultation or legal advice on any specific matter. For reprinting and legal consultation, please add customer service:mankunlawyer。