In the Web3 world, whether you are an ordinary player, a high-net-worth investor, or a project party, one of the unavoidable risks is scams.
According to the Chainalysis report (The Chainalysis 2025 Crypto Crime Report), the total amount of global on-chain crime reached 24 billion USD in 2024, of which:
The scale of fraud-related transactions reached 9.9 billion USD, with pig-butchering, phishing websites, and fake investment projects being particularly prevalent;
The amount of funds stolen exceeded 2.2 billion USD, with over 60% stemming from private key leaks and social engineering phishing;
Ransomware, market manipulation, and other criminal activities are also frequently seen.
However, looking back at these cases, you will find a commonality worth noting – no matter how advanced the technology becomes, the ultimate breakthrough point is 'human nature' itself.
That's right, the 'standard weapon' of on-chain crime is what Portal Labs is going to discuss: social engineering attacks.
What is social engineering attack?
Reality tells us that the easiest to breach is not technology, but human nature.
This is the core of social engineering attacks.
Social engineering attacks do not rely on vulnerabilities at the code level, but rather deceive you into willingly handing over sensitive information or executing dangerous operations through disguise, inducement, and manipulation.
Compared to high-threshold technical attacks, social engineering attacks have low costs and high success rates. Whether it’s fraud, fund theft, or extortion, the first step in most cases is to make you click 'confirm'.
In summary, all social engineering tactics ultimately rely on the following three axes:
Disguise authority. Impersonate customer service, official personnel, or partners to lower your guard with a 'seemingly reliable' identity.
Create a sense of urgency. Account anomalies, token airdrops, exclusive investment opportunities... make you fall into the mindset of 'if I don’t act now, I’ll lose out'.
Establish a trust closed loop. Pull you into fake groups, impersonate friends or KOLs, brainwash in groups, and induce you to step into the trap step by step.
It is worth noting that social engineering attacks are evolving systematically and professionally.
Chainalysis also pointed out that over the past three years, scam groups have gradually adopted AI face-swapping, big data profiling, and automated delivery technologies to design scripts and processes targeting different user groups.
In the future, it may no longer be sufficient to rely solely on individual vigilance to prevent all risks; systematic security solutions, cross-chain risk control, and core permission isolation will become 'standard configurations' for high-net-worth players and project parties.
Typical scenarios and real cases
Unlike technical attacks, social engineering attacks have clear targets and usually focus on specific individuals or organizations. Hackers customize scripts and design scenarios based on the behavioral habits of different groups in Web3 to harvest precisely. Common tricks include the following categories:
Targeting ordinary players
The most common tactic is 'impersonating official customer service', proactively messaging you, falsely claiming that there are account anomalies or funds frozen, requiring you to verify your seed phrase or follow instructions to unfreeze, after which your assets are instantly transferred away.
Recently, Australian authorities cracked down on a scam group impersonating the crypto exchange Binance, where these scammers led victims to call fake hotlines and transfer funds to wallets controlled by hackers.
Moreover, phishing links such as 'free airdrops' and 'NFT red envelopes' are frequently seen. The Crypto Drainers mentioned in the Chainalysis report are mostly such cases, and it’s ironically noteworthy that an attack incident occurred in January 2024. At that time, scammers breached the social media account of the U.S. Securities and Exchange Commission (SEC) to publish false airdrops, enticing users to connect their wallets to claim fake tokens, resulting in asset theft.
There are also common 'fake trading groups', especially active on Telegram and Discord. Attackers typically impersonate official personnel or steal friends' accounts to invite you into groups, where almost everyone except you is a scammer or a bot. They frequently push false projects and high-yield opportunities, waiting for you to take the bait.
Targeting high-net-worth investors
For high-net-worth individuals, attack tactics are usually more customized.
Attackers impersonate well-known KOLs, family office partners, or fund managers through channels like LinkedIn and Twitter, throwing out bait like 'exclusive financing' and 'internal investment opportunities' while coordinating forged social accounts and investment documents to create a closed 'trust circle'.
The Chainalysis report specifically mentions that in 2024, pig-butchering teams exploited false family office scams to defraud a large number of high-net-worth investors, accumulating millions of dollars in involved amounts.
Additionally, SIM card swap attacks are also common: scammers persuade telecom operators to migrate phone numbers, thus resetting your exchange account password and controlling funds.
Targeting Web3 project parties
Project teams often face scams related to cooperation invitations, business development, and technical docking.
For example, hackers may impersonate well-known CEX online launch leaders or ecosystem partners, inviting online meetings, but actually send forged Zoom video links or malicious contract files.
In 2024, Slow Mist disclosed multiple incidents of hackers forging video conference links, targeting project multi-signature authorizations and private key management. The Huione Guarantee platform mentioned in the Chainalysis report provided scam groups with AI face-swapping, fake KYC, and other services, helping them forge CEO and CTO image videos to defraud financial authorizations.
In addition, attackers often deliver malicious code links to development teams under the guise of 'SDK upgrade packages' or 'API documentation', inducing downloads.
Targeting Web3 job seekers
Social engineering attacks also frequently appear in 'recruitment' and 'part-time' information.
Attackers disguise themselves as HR from project parties, recruitment personnel from leading platforms, or forge recruitment websites to post high-paying job positions, attracting job seekers to submit resumes. Once trust is established, they often guide victims to click on forged interview links, download malicious files, or even lead them into so-called 'task platforms' to scam funds by recharging.
The Chainalysis report indicates that in 2024, pig-butchering teams have adopted false job recruitment as a new business line, enticing victims to continuously invest funds until they are unable to withdraw. Furthermore, Slow Mist has also monitored multiple job fraud cases where attackers sent malicious links through fake recruitment invites to steal wallet permissions or sensitive information.
How to prevent social engineering attacks?
You can never stop scammers from getting close to you, but you can deny them the opportunity to act.
The core idea is simple: increase sensitivity to temptation, intimidation, and trust circles, coupled with technical protection.
Only trust official channels for all information. Be sure to cross-verify through official email addresses, Twitter accounts, and Discord groups published on the official website.
Install anti-phishing plugins. Anti-phishing plugins like Wallet Guard and PhishFort can effectively intercept phishing websites and malicious links that have been flagged.
Never give out your private key and be cautious with signing authorizations. Any legitimate platform or project will not ask for your private key and seed phrase. Before signing a contract, be sure to confirm the source and calling permissions of the contract.
Project parties & core members should strictly control business connections. It is recommended that core personnel enable anti-phishing protection on their emails, use sandbox environments for document receipt, and refuse unverified SDK/API invitations.
Layer wallets and diversify assets. It is recommended to combine cold wallets and hardware wallets, isolating daily operation wallets, investment wallets, and storage wallets, and pairing them with multi-signature protection.
Cultivate a habit of 'pausing for 5 minutes' for reaction delays. For any transfers or urgent operations, force yourself to pause for 5 minutes to verify before acting. Social engineering scams fear your calmness the most.
The first step in Web3 investment is not to chase profits, but to learn how to preserve your principal.
Do not give scammers any opportunities.