A crypto job coding test scam can start when a recruiter finds a developer on LinkedIn with a role that fits their experience. The interviews feel technical, and the assessment looks like ordinary code.
For a candidate accustomed to opening repositories and running projects, the final instruction barely looks like a security decision. That is precisely why the interview has been built around it.
Overview
The recruitment process is camouflage for a system breach
A crypto job coding test scam does not rely on a one-line offer from an obvious stranger. The attacker may impersonate a real company, study the candidate’s background, and conduct several convincing video interviews.
Email comes from a lookalike domain. Interviewers discuss familiar tools and responsibilities, while keeping their cameras disabled or providing an excuse for not appearing live.
The practical assessment then sends the candidate to a spoofed website or code project. Running it installs malicious software rather than evaluating programming ability.
The target can be the employer’s wallets, not the applicant’s salary
A candidate may complete the exercise on a company-issued computer because it contains the development tools needed for work. That gives the malware a route toward repositories, cloud sessions, API keys, internal dashboards, and cryptocurrency systems.
Strong passwords and multifactor authentication may not be enough if malware steals an already authenticated browser session or credentials available on the device.
The fake job is therefore both social engineering and supply-chain access. One developer’s execution of untrusted code can expose assets controlled by an entire organization.
Authorities linked this method to an eight-figure loss
In August 2026, the Singapore Police Force and Cyber Security Agency described this recruitment scam after cryptocurrency losses totaling USD11.8 million, roughly S$15 million.
The advisory detailed a LinkedIn approach, a spoofed corporate email domain, repeated Google Meet interviews with the camera off, and a malicious coding assessment opened on a company device.
Warning signs include:
- a recruiter using a domain that differs slightly from the employer’s real domain;
- interviewers who refuse to appear on camera across several meetings;
- a coding task hosted on an unfamiliar or newly created website;
- instructions to disable security tools or ignore package warnings;
- an assessment that requires wallet software, browser profiles, or production access;
- a project containing obfuscated scripts, unusual install hooks, or unexplained binaries;
- pressure to run the test on a work computer;
- reassurance that the code is safe without a verifiable internal contact.
Why Developers Are Asked to Run the Attack Themselves
Technical candidates regularly clone repositories, install dependencies, start local servers, and execute scripts. Attackers place the malicious action inside that normal workflow so it feels like work rather than compromise.
A project can appear ordinary in an editor while dangerous behavior hides in a dependency, installer, build command, binary, or script triggered during setup.
The recruiter may provide troubleshooting help if the payload fails. Instructions to change execution policy, disable antivirus, grant permissions, or rerun a command are framed as solutions to a broken assessment.
Several interviews increase sunk time. After researching the company and meeting the team, a candidate is less likely to stop at the final hurdle over a vague security concern.
The role’s prestige adds pressure. Cryptocurrency jobs can be competitive, remote, and well paid, so asking too many questions may feel like risking the opportunity.
Attackers also choose people whose access is valuable. Developers may hold authenticated sessions, repository tokens, deployment credentials, cloud keys, or wallet administration permissions even when secrets are not saved in plain text.
A compromised device can expose coworkers through internal messages. Once inside, the attacker may impersonate the developer and request approvals that look routine.
How the Crypto Job Coding Test Scam Works
Step 1: The attacker selects a credible technical target
The recruiter searches professional profiles for developers, engineers, and employees near cryptocurrency operations. Public posts reveal skills, current employer, projects, and likely tools.
The message references those details, making it look targeted by a genuine hiring team instead of sent by a criminal campaign.
Step 2: A real company identity is copied
The attacker builds profiles, documents, and a domain resembling the employer. One added word, replaced letter, or different top-level domain can be easy to miss.
Job descriptions may be copied from real listings. Employee names and logos can be taken from public pages without the company’s knowledge.
Step 3: Video interviews create commitment
The candidate attends one or more calls where the interviewer discusses technical experience and the position. The camera stays off, often because of a claimed connection or privacy problem.
A convincing conversation does not prove employment authority. Criminals can follow scripts, use public company information, and bring several accomplices into the process.
Step 4: The coding assessment moves to a spoofed site
The candidate receives a link to download starter files, clone a project, or sign into an assessment portal. The site resembles the company or a familiar testing service.
The domain and ownership are rarely verified because the task arrives at the expected point in the interview.
Step 5: Setup instructions execute the malware
A command installs packages or launches the project. Hidden code then contacts attacker infrastructure, steals data, or opens continued access to the device.
If security software blocks the action, the recruiter may claim it is a false positive and provide steps that weaken the computer’s defenses.
Step 6: Authenticated access is harvested
The malware can target browser cookies, session tokens, password stores, API credentials, code repositories, cloud consoles, and internal communication tools.
Stealing a live session may let an attacker pass an account boundary without entering the password or completing a fresh MFA challenge.
Step 7: Cryptocurrency is transferred or wider access is sold
With internal credentials, the attacker searches for wallet access, transaction workflows, approval rights, or systems that can be changed to redirect funds.
The same foothold may support data theft, extortion, or attacks on partners. The fake recruiter can disappear while the intrusion continues.
How to Test Code Without Trusting the Recruiter
Verify the vacancy on the company’s official careers page. Then contact its hiring team through an address published on that domain, not by replying to the recruiter.
Compare every character in the sender’s domain with the employer’s real domain. Display names and logos are decoration; the domain identifies the route.
Ask where the assessment is documented and who owns the repository. A genuine recruiter should understand why candidates need a safe way to inspect unfamiliar code.
Never run an interview project on a production workstation or a device holding privileged sessions. Use an isolated, disposable environment with no secrets, shared folders, clipboard access, or corporate network connection.
Review package scripts and dependency changes before installation. Look for obfuscated code, downloads from raw IP addresses, encoded commands, credential discovery, and unexpected operating-system access.
Do not paste commands you do not understand. A short terminal line can download and execute additional code that is not visible in the original project.
Report security warnings to the real company. A demand to disable protections should end the assessment until an independently verified employee explains the issue.
The Business Risk Begins Before Any Wallet Moves
A missing balance may be the first obvious symptom, but the intrusion begins when untrusted code runs. Treat the entire device and every accessible service as potentially exposed from that moment.
Revoking a wallet key alone may leave cloud sessions, repositories, and communication accounts open. Response must cover the full identity and system footprint.
Organizations should keep high-value transaction controls outside ordinary developer sessions. Device binding, short-lived credentials, multiple approvals, and independent limits can contain damage when one account is compromised.
Repositories and deployment pipelines need audit logs that cannot be changed by the same compromised identity. Review new keys, workflow edits, package changes, and unusual access after the suspected execution time.
Internal teams should warn coworkers quickly. An attacker using the developer’s genuine account can send highly convincing requests for credentials, files, or approvals.
Job seekers should not be blamed for encountering a polished process. The useful lesson is procedural: recruitment code is untrusted code until the employer and environment are independently verified.
What to Inspect Inside a Suspicious Assessment
Begin with the project manifest and installation scripts. Commands that run automatically before or after dependency installation deserve attention, especially when they launch shells, fetch remote files, or inspect the operating system.
Check recently added dependencies against their official registries. Typosquatted package names can differ from trusted libraries by one character while executing attacker-controlled code during setup.
Search for encoded strings, long unreadable commands, dynamic execution, credential paths, browser-profile access, clipboard monitoring, and network requests to raw IP addresses. None belongs in a simple hiring exercise without a clear explanation.
Binary files require separate caution because code review cannot reveal their behavior. Ask why a portable assessment needs an executable or precompiled library that is not available from a known publisher.
Observe the requested permissions. Administrator access, disabled endpoint protection, wallet connections, SSH keys, cloud credentials, or production configuration are unnecessary for evaluating ordinary programming skills.
Submit questions through the verified employer, not the sender. A legitimate hiring team can explain its assessment architecture and provide a clean copy through an established platform.
If the code has already run, stop investigating on the affected machine. Continued exploration can destroy evidence, expose more credentials, or tell the malware that somebody noticed it.
Record what you remember from a separate clean device. The exact command, time, error message, and recruiter response can help responders reconstruct the intrusion.
Company, Address, and Fulfillment Checks
The recruiter must be confirmed by the employer
Find the company independently and ask its human-resources or security team whether the person, role, and interview schedule are genuine.
A LinkedIn profile with connections can be copied, compromised, or built over time.
The domain must match the official company address
Compare the email, careers page, assessment site, and repository owner character by character. Search results and sponsored links can point to copies.
A genuine-looking subdomain is irrelevant if the registered parent domain belongs to somebody else.
Technical support must not weaken your device
Legitimate assessment support should explain requirements and offer a safe alternative. It should not demand disabled antivirus, broad administrator rights, or work-device execution.
Escalate suspicious instructions through the company’s published security contact.
The assessment must be traceable and reproducible
Ask for written scope, expected commands, package sources, and a safe submission route. Keep hashes or copies of the supplied files for later investigation.
A disappearing download link and undocumented binary make accountability impossible.
What to Do if You Have Fallen Victim to This Scam
- Disconnect the device. Remove it from wired, wireless, VPN, and corporate connections without continuing to browse or inspect files on the same system.
- Alert your security team immediately. Provide the recruiter profile, domains, meeting details, commands, repository, files, and exact execution time.
- Revoke active sessions. From a clean device, invalidate email, cloud, repository, messaging, wallet, and password-manager sessions rather than only changing passwords.
- Rotate exposed credentials. Replace API keys, tokens, SSH keys, recovery codes, deployment secrets, and wallet permissions accessible to the compromised account.
- Freeze high-value transactions. Contact exchanges, custodians, and financial partners. Move remaining assets only through the organization’s incident process.
- Preserve evidence before rebuilding. Security responders may need logs, memory, files, network data, and disk images. Do not wipe the device before they advise.
- Scan affected endpoints. Malwarebytes can help detect commodity credential stealers, but an enterprise compromise still requires professional incident response and possibly a full rebuild.
- Block campaign infrastructure. AdGuard can reduce access to known malicious domains and redirects on personal devices, while business controls should block indicators across DNS, web, and email layers.
- Notify the impersonated company. Send the evidence through its official security contact so it can warn applicants and seek removal of fake domains.
- Report the crime. Contact local law enforcement and the relevant cybercrime agency. US victims and companies can also report to IC3.gov.
Frequently Asked Questions
Are coding assessments from recruiters always dangerous?
No, but any unfamiliar code can be harmful. Verify the employer and run assessments only in an isolated environment without secrets.
Can malware bypass multifactor authentication?
It may steal an already authenticated session or token, allowing access without repeating the normal login process.
Does a real LinkedIn profile prove the recruiter is genuine?
No. Profiles can be copied or compromised. Confirm the person through the employer’s independently sourced contact details.
Is a virtual machine enough protection?
It reduces risk only when properly isolated. Remove shared credentials, folders, clipboard access, host networking privileges, and corporate connections.
Should I simply delete the downloaded project?
Not after execution. Disconnect the device and let incident responders preserve evidence, assess persistence, and determine which systems were exposed.
Could my employer be responsible for the loss?
Liability depends on contracts, controls, and local law. Report immediately, preserve facts, and let the organization obtain appropriate legal advice.
The Bottom Line
A crypto job coding test scam turns a developer’s normal habit of running code into a route toward wallets, repositories, and company systems.
Verify the recruiter through the real employer and treat every assessment as hostile until inspected in isolation. A polished interview cannot make an unknown download safe.
