Singapore Authorities Warn of $11.8M Fake LinkedIn Crypto Job Scam

A cryptocurrency scam that features fake job offers and malicious coding assessments has led to losses of US$11.8 million, according to Singaporean authorities.

The Singapore Police Force and Cyber Security Agency of Singapore said a victim was contacted by a scammer on LinkedIn posing as a recruiter for a cryptocurrency company. The conversation then moved to email, where the fraudster used a spoofed domain similar to one used by a legitimate business.

After several Google Meet interviews in which the scammer kept their camera switched off, the interviewee was instructed to visit a website to complete a technical coding assessment using the victim’s company-issued device.

Malware downloaded during the assessment captured an authenticated session token, allowing the attackers to bypass multi-factor authentication and access the victim’s Bitbucket account. As the account was connected to the employer’s code repository, the attackers were able to compromise internal servers and obtain company credentials to circumvent transaction limits and checks to transfer cryptocurrency.

The company has not been named. The Singapore Police Service and Cyber Security Agency have urged the public to verify recruiters and companies through official company channels and avoid downloading files or executing code from unverified sources. Businesses are urged to protect their API keys and internal credentials as well as introduce transaction safeguards that cannot be easily overridden.