Social Engineering, Not Smart Contracts, Is Draining Crypto Wallets

Crypto's biggest attack surface in late 2024 has had little to do with faulty code. Repeatedly, all it has taken to drain a wallet is a single click: on a hijacked tweet, an unaudited token's "buy" button, or a booby-trapped image file.

The scale of the problem was underlined again last week when a whale lost $35 million worth of fwDETH, according to a report from Scam Sniffer, in what was described as a phishing attack rather than a protocol exploit.

The trigger for the latest scare was an account takeover at Symbiotic. On October 5, the protocol's X account was compromised and used to push a fake points-redemption promotion. The hijacked posts pointed followers to a lookalike domain, "network-symbiotic[.]fi," where victims were invited to connect their wallets and claim rewards - and had them emptied instead.

Symbiotic's case was only the latest entry in a longer pattern. Earlier in the summer, a wave of domain hijackings tied to Squarespace hit an established list of DeFi projects, including Coinlist, dYdX, Celer Network, Compound Finance, and Pendle Finance. In several instances both the affected projects' websites and their X accounts were compromised, and each captured account then funneled followers toward malicious sites. None of these incidents required a smart-contract exploit - only a hijacked account, a tempting offer, and users willing to connect their wallets.

A newer vector: malware hidden in image files

Beyond compromised accounts, researchers have also documented a less obvious threat: malicious SVG image files. The technique, detailed by Cofense and referenced in HP's Wolf Security Threat Insights report for September 2024, was the same method used in the Symbiotic account takeover.

The mechanism works as follows: an SVG file, once opened in a browser, unpacks into a ZIP archive. Opening that archive triggers a shortcut file to download. Running the shortcut loads a decoy PDF as a distraction while, in the background, malicious scripts quietly embed themselves in the system's music, photo, and startup directories - installing what amounts to a Remote Access Trojan (RAT). The end result is full control of the victim's device, wallets included.

The human layer keeps failing

According to security researcher Sudo (pcaversaccio), people continue to lose assets daily to routine Web2-style failures, generating a steady flow of SEAL 911 emergency tickets tied to phishing and malware rather than to any novel contract bug. It is not a problem showing signs of fading.

Security groups such as the Security Alliance have compiled defensive checklists in response. Recommended practices commonly cited include:

• Hardware security: using a hardware key such as a Yubikey for account logins, and a hardware wallet for holding crypto assets.
• Multi-factor authentication: enabling MFA everywhere, preferably app-based or hardware-token MFA rather than SMS.
• Password managers: generating and storing unique, complex passwords per account.
• Revoking approvals: periodically checking and revoking token approvals through services such as Revoke.cash, since signature-based approvals do not expire on their own.
• Scrutinizing alerts: verifying sender addresses on account-related emails and avoiding embedded links entirely.
• Transaction previews: using wallets that preview what a signature actually authorizes, and practicing with tools such as the Limitless CTF, which trains users to evaluate transactions and infinite approvals critically.

Locking down an X account specifically

SEAL's Twitter/X security self-audit lays out steps aimed particularly at protocol founders, DeFi teams, and influencers, whose accounts are attractive hijacking targets precisely because a takeover can turn an entire community into phishing victims:

• Remove the phone number tied to the account - it is a common vector for SIM-swap attacks - and substitute a VOIP number where possible.
• Use an authenticator app or hardware security key for 2FA instead of SMS.
• Review delegated accounts and remove any that aren't recognized.
• Enable password-reset protection.
• Revoke access from unnecessary connected apps.
• Log out of inactive sessions.
• Update the recovery email to a current, actively monitored address.
• Change passwords that haven't been rotated in a long time.
• Add a hardware security key for extra protection.
• Watch for and avoid suspicious login requests, a documented example of which circulated recently.

A simple defense that keeps getting skipped

Free airdrops, exclusive pre-sales, and offers of overnight riches remain, overwhelmingly, too good to be true. Suspicious URLs can be checked through a scanner such as URLscan.io before any interaction with them.

Taken together, these incidents suggest that the industry's technical security has in some respects outpaced its operational security. A compromised social media account can do as much damage as a compromised smart contract, since it turns a project's own audience into a target list. Whether defenses against social engineering can keep pace with the rate at which new phishing and malware techniques emerge remains an open question.