Why Social Engineering Scams Are the New Frontier in Crypto Security

The landscape of security within the cryptocurrency and blockchain sectors has undergone a seismic shift recently. Traditional threats like exploits in smart contracts and brute force attacks are being eclipsed by more insidious forms of fraud, particularly social engineering scams, which include rug pulls and pump-and-dump schemes.

To gain insight into these evolving threats, we spoke with a representative from CertiK, a leading security firm. They discussed how blockchain vulnerabilities are changing and how both projects and individual users can protect themselves from potential threats.

Surge of Social Media-Related Hacks

In recent months, the crypto community has witnessed a concerning rise in social media-related hacks. This trend represents a significant shift from the increasingly sophisticated blockchain attacks that were once prevalent in the news.

While hacking smart contracts or blockchain networks demands a higher skill level, cybercriminals have turned their attention to targeting social media accounts instead, offering a simpler route to executing scams.

“Social media accounts have become attractive targets due to their broad reach and the trust that followers place in verified profiles. Compared to complex blockchain attacks, hijacking a social media account provides a quicker and less technically demanding way to disseminate scams to a wide audience. The growing frequency of such breaches indicates a move towards social engineering and credential theft instead of direct blockchain exploitation,” stated a spokesperson from CertiK.

The increase in social media hacking means that more malicious actors can easily enter this space, exploiting users with less technical proficiency.

“This trend may also be partly due to a skills gap among malicious actors. For example, drainer-as-a-service has opened doors for scammers who lack the expertise to manipulate smart contracts. Many of these scammers hail from younger generations who are more likely to discuss their financial activities online, thus encouraging more individuals to use social media for nefarious purposes,” the spokesperson added.

X: The New Playground for Web3 Hackers

Following the launch of a meme coin by former US President Donald Trump, high-profile X (formerly Twitter) accounts quickly became targets for hackers eager to exploit the excitement around such initiatives, often persuading followers to invest in fraudulent meme coins.

Most recently, hackers seized control of the X account belonging to Mahathir Mohamad, the former Prime Minister of Malaysia, to promote a bogus meme coin named MALAYSIA, erroneously advertised as the nation’s official cryptocurrency. Although the scam post was removed within an hour, it had already resulted in losses estimated at $1.7 million, linked to the notorious Russian hacking group, Evil Corp.

“Given that X is the most popular crypto-focused social media platform, it’s logical that high-profile accounts on this site have become prime targets to attract a greater number of victims,” noted a CertiK representative.

This particular incident transpired just two weeks after hackers exploited the social media account of Brazil’s former President Jair Bolsonaro, promoting the BRAZIL token, which skyrocketed in value, yielding over $1.3 million for the scammers.

Increased Attacks on Tech Companies

Tech firms are also not immune. Last December, the X account of AI research company Anthropic was compromised, with a fraudulent post claiming to introduce a fake token, CLAUDE, intended to incentivize AI and crypto initiatives. This scam managed to siphon around $100,000 from unsuspecting investors.

“The frequency of these breaches is concerning. The compromise of accounts belonging to global leaders and tech firms illustrates how hackers are leveraging platforms with extensive reach to amplify fraudulent cryptocurrency schemes. This marks a critical shift in tactics, indicating that social media is becoming a primary vehicle for crypto scams,” emphasized the CertiK spokesperson.

Such breaches also underscore pervasive weaknesses in social media account security, making influential individuals susceptible to threats that adversely affect the broader crypto environment.

Political Tokens and Their Consequences

The launch of TRUMP marked a notable peak in socially engineered scams. In January, Ethereum co-founder Vitalik Buterin expressed his concerns regarding such politically themed tokens and their susceptibility to misuse.

“It's time to acknowledge that large political coins cross a significant line; they are not just sources of entertainment but platforms for unrestricted political bribery, including interference from foreign nations,” stated Buterin.

Buterin highlighted the potential for these tokens to facilitate scams and political corruption, pointing out regulatory loopholes that have enabled such behaviors.

The issue extends beyond political themes and into broader realms of fraud. A week after Buterin's warnings, an alarming incident occurred where a Coinbase user lost $11.5 million due to a social engineering ploy on Base. Analyst ZackXBT revealed a troubling trend of increasing losses, suggesting that total losses related to scams affecting Coinbase customers could be around $150 million.

“Coinbase is facing a serious fraud issue. I have uncovered multiple thefts from Coinbase users recently. The $150 million reported is likely just a fraction of the actual amount stolen, as many more cases exist,” stated ZackXBT.

Social engineering scams typically employ tactics such as phishing emails and spoofed communications to manipulate victims into divulging sensitive information, enabling scammers to drain accounts rapidly.

According to CertiK, these developments indicate an urgent requirement for enhanced security measures in the crypto landscape.

“Web3 security platforms are evolving to broaden their focus beyond smart contract vulnerabilities to encompass a wider array of threats, particularly those relating to social engineering risks. Many firms are now employing AI-driven tools to monitor and flag suspicious account activities on social media while educating users about the dangers of impersonation scams. Addressing the evolving threat landscape necessitates a holistic security approach that merges traditional blockchain protections with social media safeguards,” the spokesperson commented.

Proactive Security: A Necessity in a Rapidly Expanding Market

The burgeoning Web3 sector, marked by a wave of new crypto project launches, presents both exciting opportunities and daunting security challenges. Studies suggest that the Web 3.0 market could grow from USD 4.62 billion in 2025 to around USD 99.75 billion by 2034, suggesting a significant compound annual growth rate (CAGR) of 41.18% during this period.

However, CertiK warns that security must not take a backseat as the demand for new projects continues to escalate.

“Despite the surge in new projects, adherence to rigorous audit protocols is often inconsistent. While some projects make security a top priority, others rush to market, compromising safety for speed in pursuit of quick profits,” remarked the CertiK spokesperson.

The rapid influx of new Web3 initiatives makes it increasingly challenging for security firms to meet the growing demand effectively.

“Although awareness of the importance of audits is on the rise, the volume of new launches can outpace the capabilities of security firms, resulting in vulnerabilities. This underlines the need for standardized auditing requirements within the industry,” the spokesperson concluded.

As we navigate this evolving landscape, it becomes imperative that security is not an afterthought but rather a foundational element of every Web3 project and user interaction, ensuring robust protection against escalating threats.