In the Web3 world, whether you are an ordinary player, a high-net-worth investor, or a project party, one of the unavoidable risks is scams.
According to the Chainalysis released (The Chainalysis 2025 Crypto Crime Report), the total amount of on-chain crime worldwide reached $24 billion in 2024, including:
The scale of fraud-related transactions reached $9.9 billion, with pig-butchering, phishing websites, and fake investment projects particularly rampant;
The amount of funds stolen exceeded $2.2 billion, with over 60% stemming from private key leaks and social engineering phishing;
Ransomware, market manipulation, and other criminal activities are also frequently seen.
However, looking back at these cases, you will find a commonality worth being alert to - no matter how advanced the technology, the ultimate breakthrough point is 'human nature' itself.
That's right, the 'standard weapon' of on-chain crime is exactly what Portal Labs wants to discuss: social engineering attacks.
What is social engineering attack?
Reality tells us that the easiest to break through is not technology, but human nature.
This is the core of social engineering attack.
Social engineering attacks do not rely on code-level vulnerabilities, but instead use disguise, inducement, and manipulation to trick you into voluntarily handing over sensitive information or performing dangerous actions.
Compared to high-threshold technical attacks, social engineering attacks are low-cost and high-success rate. Whether it's fraud, fund theft, or extortion, the first step in most cases is getting you to click 'confirm'.
Summarizing all social engineering tricks, they actually revolve around the following three axes:
Disguise authority. Impersonate customer service, official personnel, or partners to lower your guard with a seemingly reliable identity.
Create a sense of urgency. Account anomalies, token airdrops, exclusive investment opportunities... making you fall into the mentality of 'if I don't act now, I'll lose'.
Establish a trust loop. Pull you into fake groups, impersonate friends or KOLs, brainwash in groups, leading you step by step into traps.
It is worth noting that social engineering attacks are evolving in a systematic and professional manner.
Chainalysis also pointed out that over the past three years, scam groups have gradually adopted AI face-swapping, big data profiling, and automated deployment technologies to design scripts and processes targeting different user groups.
In the future, relying solely on individual vigilance may not be enough to prevent all risks; systematic security solutions, cross-chain risk control, and core permission isolation will become 'standard configurations' for high-net-worth players and project parties.
Typical scenarios and real cases
Unlike technical attacks, social engineering attacks have clear targets, usually targeting specific individuals or organizations. Hackers customize scripts and design scenarios based on the behavioral habits of different groups in Web3, accurately harvesting. Common tricks include the following categories:
Targeting ordinary players
The most common trick is 'spoofing official customer service', proactively messaging you, falsely claiming that there is an anomaly with your account, funds are frozen, requiring you to verify your mnemonic phrase or follow operations to unfreeze, after which your assets are instantly transferred away.
Recently, Australian authorities have cracked down on a scam group impersonating the cryptocurrency exchange Binance, where these scammers led victims to call fake hotlines and transfer funds to wallets controlled by hackers.
Additionally, phishing links related to 'free airdrops' and 'NFT red envelopes' are frequently seen. The Crypto Drainers mentioned in the Chainalysis report mostly belong to this type of case, and ironically, an attack event occurred in January 2024. At that time, the scammers hacked the social media account of the U.S. Securities and Exchange Commission (SEC), published fake airdrops, and lured users to connect their wallets to receive fake tokens, resulting in asset theft.
There are also common 'fake trading groups', especially active on Telegram and Discord. Attackers often impersonate official personnel or steal friends' accounts to invite you into the group, where apart from you, almost everyone else are scammers or bots, frequently pushing false projects and high-return opportunities until you take the bait.
Targeting high-net-worth investors
For high-net-worth individuals, the attack tactics are usually more customized.
Attackers disguise themselves as well-known KOLs, family office partners, or fund managers through channels like LinkedIn, Twitter, throwing out bait such as 'exclusive financing' and 'internal investment opportunities', combined with forged social media accounts and investment documents to create a closed 'trust circle'.
The Chainalysis report specifically mentions that in 2024, pig-butchering teams used fake family office scams to defraud a large number of high-net-worth investors, with a cumulative amount involved of tens of millions of dollars.
Moreover, SIM card swapping attacks are also common: scammers persuade telecom operators to migrate phone numbers, thereby resetting your exchange account password and controlling funds.
Targeting Web3 project parties
Project teams often face scams related to cooperation invitations, business expansion, and technical docking.
For example, hackers impersonate well-known CEX launch leaders and ecological partners, inviting online meetings, while actually sending fake Zoom video links or malicious contract files.
In 2024, Slow Fog disclosed several incidents of hackers fabricating video conference links, targeting project multi-signature authorization and private key management. The Huione Guarantee platform mentioned in the Chainalysis report provides AI face-swapping, fake KYC, and other services for scam groups, helping them forge videos of CEOs and CTOs to obtain financial authorization.
In addition, attackers often deliver malicious code links to development teams under the guise of 'SDK upgrade packages' or 'API documentation', luring them to download.
Targeting Web3 job seekers
Social engineering attacks also frequently appear in 'recruitment' and 'part-time job' information.
Attackers pose as project HR, top platform recruiters, or create fake recruitment websites to post high-paying jobs, attracting job seekers to submit resumes. Once trust is established, they often guide you to click on fake interview links, download malicious files, or even lead you into so-called 'task platforms' to scam funds through order brushing and top-ups.
The Chainalysis report indicates that in 2024, pig-butchering teams have made false recruitment a new business line, inducing victims to continuously invest funds until they can no longer withdraw. Additionally, Slow Fog has also monitored multiple job scam cases where attackers send malicious links through fake job invitations to steal wallet permissions or sensitive information.
How to prevent social engineering attacks?
You can never stop scammers from approaching you, but you can deny them the opportunity to take action.
The core idea is simple: increase sensitivity to temptation, intimidation, and trust circles, combined with technical protection.
Trust only official channels for all information. Be sure to cross-verify through official emails, Twitter accounts, and Discord groups.
Install anti-phishing plugins. Anti-phishing plugins like Wallet Guard and PhishFort can effectively intercept phishing websites and malicious links that have been flagged.
Never give your private key, be cautious with signature authorizations. Any legitimate platform and project party will never ask for your private key and mnemonic phrase. Before signing contracts, be sure to confirm the source of the contract and the calling permissions.
Strictly control business docking for project parties & core members. It is recommended that core personnel enable anti-phishing protection on their emails, use sandbox environments for file reception, and reject unverifiable SDK/API invitations.
Layer wallets and diversify assets. It is recommended to use a combination of cold wallets and hardware wallets, layering and isolating daily operation wallets, investment wallets, and storage wallets, along with multi-signature protection.
Cultivate the habit of a '5-minute pause' response delay. For any actions involving transfers or urgent operations, force a 5-minute pause to verify before proceeding. Social engineering scams fear your calmness.
The first step in Web3 investment is not to chase profits, but to learn how to protect your principal.
Do not give scammers any opportunity.