Fake Crypto Job Scams

Fake crypto job scams use fraudulent employment opportunities in the cryptocurrency and Web3 sector to steal money, credentials, or install malware on victims' devices. The crypto industry's rapid growth, high advertised salaries, and remote-first culture make it a compelling context for job fraud, and the technical complexity of the sector gives scammers opportunities to introduce malicious steps into an apparently normal hiring process.

These scams take several distinct forms. In the pay-to-work variant, victims are told they must purchase equipment, software, or cryptocurrency as part of onboarding — money that is simply taken. In the credential-harvest variant, a convincing hiring process collects sensitive personal and financial information that is used for identity theft or account takeovers. In the malware delivery variant — increasingly common — the 'job' involves a technical task that requires downloading software, which is actually a trojan or remote access tool giving the attacker control of the victim's device.

The malware variant is particularly targeted at software developers, content creators, and security researchers who would plausibly download and run code or software as part of a job interview or assignment. A coding test, a video call application, a 'custom collaboration tool', or a project repository can all serve as delivery vectors. Once the malware is installed, it can harvest wallet credentials, extract browser-stored passwords, and give the attacker persistent access to the victim's device.

Some fake job scams are linked to broader organised fraud operations that use employed 'workers' as intermediaries in money laundering or as recruiters for pig-butchering schemes — a situation where the 'employee' may themselves become a victim of wage theft, coercion, or legal jeopardy.

A job offer arrives via LinkedIn, a job board, a freelance platform, or direct message. The role is typically well-paid, remote, and in a plausible position: developer, community manager, content creator, marketing lead, or security researcher. The posting may use real company names and branding, or the names of known projects.

An initial screening process builds credibility — there may be email exchanges, a written application, or a call with someone playing the role of a recruiter. The process is designed to feel legitimate enough that the candidate invests time and develops a sense of commitment.

At a key stage, the malicious element is introduced. In the equipment or software purchase variant, the candidate is told to buy hardware or software from a specific vendor, sometimes with a promise of reimbursement that never comes. In the credential-harvest variant, tax and banking forms or 'security verification' asks for sensitive personal information.

In the malware variant — particularly targeting developers — the candidate is asked to complete a coding test by cloning a repository, run a custom tool for a video interview, install a proprietary collaboration environment, or review a project's codebase. The repository or installer contains obfuscated malicious code. Once executed, the malware deploys silently.

For non-technical roles, a 'training portal' or 'onboarding app' may serve the same purpose.

Job seekers are motivated to complete tasks and demonstrate competence. The hiring context normalises a degree of compliance — following instructions, installing required software, completing assignments — that would be questioned in other contexts. Crypto roles in particular often involve technical tooling that candidates accept without scrutiny.

The prospect of a well-paying remote role creates emotional investment that reduces scepticism. A candidate who has spent two hours on an interview process is less likely to pause at a final instruction that would have seemed suspicious at the start.

The technical complexity of the crypto sector means that requests involving unusual tools, blockchain connections, or token-related tasks can seem plausible to outsiders unfamiliar with what is genuinely standard.

A developer receives a LinkedIn message from a recruiter at what appears to be a known blockchain protocol. After a brief exchange, they are asked to complete a technical assessment by cloning a GitHub repository and running a setup script. The script executes without obvious errors and the task completes. Several days later they notice unfamiliar transactions in their connected wallets and their saved browser passwords have been used to access accounts. Investigation reveals the repository's setup script contained obfuscated code that installed an infostealer on their machine. The recruiter's profile was fake.

Hi, I came across your profile and think you'd be a great fit for our [role] position at [company]. DM me to learn more.

We're hiring remote [role] at [amount]/month. No experience needed, full training provided. Apply: [fake link]

Congratulations — you've been selected for our developer trial. Clone this repo and run the setup to complete your assessment: [fake link]

To complete onboarding, please purchase the required [software/hardware] from our certified vendor: [fake link]. You will be reimbursed on your first paycheck.

Our video interview platform requires a quick install — download it here before our call: [fake link]

Before we can proceed, please complete identity verification through our portal: [fake link]

Verify any job offer by searching for the company independently through official channels — not the link in the offer. Check whether the company has a real, established web presence, verifiable staff on professional networks, and genuine job listings on their official site.

Be sceptical of any job that requires upfront payment, equipment purchase, or cryptocurrency deposit as part of onboarding. Legitimate employers pay for required tools; they do not ask candidates to fund them.

Never run code, install software, or execute scripts from a job application unless you have independently verified the employer's identity and the code's contents. For developer roles, review any repository carefully before running it — ideally in an isolated or sandboxed environment.

Be cautious of roles found via direct message or unsolicited outreach from someone you have not previously engaged with.