Social Engineering, Not Code Flaws, Drove Crypto's 2024 Security Failures

Blockchain networks are frequently marketed as cryptographically secure by design, but the pattern of incidents through the first half of 2024 suggests the weakest point in crypto security is rarely the code itself — it is the people operating around it.

Credit for reporting and research referenced below: Scam Sniffer, Decrypt, Tayvano, ZachXBT, The Block, Elliptic, and Officer's Blog.

In May 2024, Evolve Bank and Trust suffered a major breach after a single employee clicked a malicious link. The ransomware group LockBit used that opening to exfiltrate 33 terabytes of data. The incident touched more than 155,000 accounts tied to Bitfinex, Copper Banking, and Nomad, exposing names, addresses, Social Security numbers, and account balances.

A comparable failure hit the protocol layer in June, when a threat actor compromised the mailing list provider used by Ethereum, sending a phishing email carrying a wallet-drainer link to more than 35,000 addresses. Ethereum disclosed the incident in a blog post and said it had no material impact on users — though whether that counts as a near-miss is debatable.

Phishing losses accelerate

Per Scam Sniffer's mid-year phishing report, roughly 260,000 victims lost a combined $314 million to phishing across EVM chains in just the first six months of 2024, already exceeding the $295 million stolen over the whole of the prior year.

Among the top 20 individual victims, most large ERC-20 token thefts relied on signature-phishing methods — Permit, IncreaseAllowance, and Uniswap's Permit2 — that get users to sign away token approvals rather than surrender private keys outright. Much of the value taken this way came out of staking, restaking, Aave collateral positions, and Pendle tokens, all of which support the Permit standard; once assets are signed away through Permit, they generally cannot be recovered.

One illustrative case: a victim lost $11 million in aEthMKR and Pendle USDe tokens after signing several Permit phishing requests. The transfer is recorded in transaction 0x8d0360632bc385171e20c12aa3152933bb041402bb3e06ab29136985a4745e57, moving funds from victim address 0xfb94d3404c1d3d9d6f08f79e58041d5ea95accfa to attacker address 0x739772254924a57428272f429bd55f30eb36bb96.

Scam Sniffer also found that most phishing campaigns trace back to impersonator accounts on X, a dynamic also visible in phishing activity targeting other ecosystems. Several previously legitimate, hijacked accounts have been used to promote Solana meme coins, including those associated with Doja Cat, Hulk Hogan, 50 Cent, and Metallica. These hijacking cases are separate from instances where celebrities have knowingly promoted their own speculative tokens.

State-sponsored operators

A more deliberate category of threat comes from state-linked groups, chief among them North Korea's Lazarus Group — widely regarded as one of the most active adversaries facing the crypto industry. Rather than hunting for smart-contract bugs, Lazarus tends to go after people directly, following a recognizable playbook: reach out to an employee over social media or messaging apps, direct them to a GitHub repository under the guise of a job offer or bug bounty, compromise their device, then use that foothold to gain unauthorized access to company systems and, ultimately, company and user funds.

Security researcher Tayvano documented one case in which a Lazarus operative built a fake LinkedIn profile to approach two technical staff members at a single company. The attacker infected the first employee's device with malware and paid them $100 in USDT to help maintain the cover story. Once it became apparent that this employee lacked the access needed, the operative shifted to the second employee, compromised their device too, and carried out a significant theft a month later.

A similar scheme targeted CoinsPaid, whose staff were contacted by fake recruiters on LinkedIn dangling salaries of up to $24,000 a month. Employees were induced to install malware framed as part of a "test assignment," a ruse that led to a $37.3 million theft.

The largest crypto hack on record — the $625 million Axie Infinity hack — has been traced to a single engineer opening a malicious PDF sent as a fake job offer.

These episodes point to a group that is patient, adaptable, and willing to operate across whatever channel — Telegram, Slack, email, Discord — gets it closest to a target. For further background, ZachXBT has written about how Lazarus laundered roughly $200 million across more than 25 crypto hacks, and Tayvano maintains a research archive covering incidents tied to Lazarus and associated groups.

A marketplace for crime-as-a-service

Where Lazarus represents custom, state-directed operations, a Cambodia-based network known as Huione Guarantee shows the other end of the spectrum: cybercrime sold as an off-the-shelf product. Operating across thousands of channels on instant-messaging platforms, Huione offers services including money laundering, purpose-built scam websites, and the sale of recently stolen personal data. Its offerings reportedly extend to torture equipment allegedly used against enslaved workers held inside scam compounds.

Elliptic's analysis found more than $11 billion has moved through Huione-linked crypto wallets since 2021. A Huione subsidiary, Huione International Payments, separately offers laundering services of its own for a fee.

Messaging apps as an entry point

A large share of crypto activity happens on X and Telegram, and both carry real security risk. X's exposure comes mainly from account compromises and phishing links. Telegram shares that risk and adds another: it has become a hub for one-time-password (OTP) bots that undercut two-factor authentication.

The mechanism works like this: after obtaining login details through a data breach or phishing attempt, an attacker uses an AI-driven bot to call the victim while posing as their bank. The bot talks the victim into reading out the one-time code that was legitimately sent by their actual service provider; once that code is handed over, the attacker gains near-instant access to the account. These bots are sold as a subscription service, complete with features like caller-ID spoofing and adjustable voice profiles — turning 2FA, as the source material puts it, into a speed bump rather than a real barrier, as documented by Kaspersky.

Encrypted apps have not been spared either. Signal's desktop client was found to store encryption keys in plaintext, a flaw that could allow an attacker to read chat history or clone an active session. Signal has downplayed the severity of the issue, but security researchers continue to call for stronger local data protection.

Discord's setup is weaker still: it relies on transport layer security (TLS) to encrypt messages only while they are in transit, without end-to-end encryption. That means Discord itself — and anyone who breaches Discord's own systems — can potentially see user communications. Combined with a persistent phishing problem, this has enabled schemes like those run by the group Pink Drainer, which has used Discord to steal millions of dollars in digital assets across a series of targeted phishing incidents. Beyond phishing, a widely shared YouTube video, "Infiltrating a Discord Bot that Spies on People," demonstrated other ways Discord bots can be turned to surveillance. Together, the lack of end-to-end encryption and ongoing phishing exposure have led to stolen gaming and Discord accounts, spam campaigns, and leaked personal information for affected users.

Limiting exposure

None of this makes crypto users defenseless — the fixes here are mostly about reducing reliance on any single person, device, or credential rather than waiting on new cryptography. Recommended practices include:

• Favoring multisig arrangements over a single private key for teams and protocols, since private-key compromise remains one of today's most common attack vectors
• Keeping funds in cold storage instead of hot wallets wherever feasible
• Never clicking links or downloading files sent by unknown parties
• Avoiding SMS-based two-factor authentication in favor of authenticator apps or hardware security keys
• Using separate devices for personal activity versus crypto-related activity
• Regularly checking and revoking token approvals, for instance via Rabby or RevokeCash

For more detail, Officer's Blog has published a guide to security tools and practices for crypto users working remotely, along with a separate write-up on how attackers gain access to and compromise personal devices.

Across phishing campaigns, state-sponsored social engineering, commercialized scam infrastructure, and vulnerable messaging platforms, the common thread through the first half of 2024 is the same: the biggest weakness in crypto security isn't the cryptography — it's the humans holding the keys to it.