Lazarus operators spear-phished a senior Sky Mavis engineer through a fake LinkedIn recruiting process and a spyware-laced job-offer PDF.
Social Engineering Examples·6 sources
On March 23, 2022, attackers drained 173,600 ETH and 25.5 million USDC from the Ronin bridge, the Ethereum-side gateway for Sky Mavis's Axie Infinity game. The theft went unnoticed for six days until, on March 29, a regular user could not withdraw 5,000 ETH and found the bridge short of funds. Sky Mavis disclosed the breach publicly. On April 14, 2022 the U.S. Treasury's OFAC added the primary attacker Ethereum address (0x098B716B8Aaf21512996dC57EB0615e2383E2f96) to the SDN list and, working with the FBI, attributed it to North Korea's Lazarus Group.
Sky Mavis published a detailed post-mortem on April 27, 2022. Reporting by The Block, corroborated by the company post-mortem, established that the entry point was a fake job offer delivered through LinkedIn: a senior engineer was courted with a bogus recruiting process and sent a malicious offer document (reported as a PDF / Word file) that deployed spyware on opening.
This is a real, well-documented, government-attributed incident.
The operators posed as recruiters from a company that did not exist and approached Sky Mavis staff on LinkedIn, encouraging them to apply. One senior engineer was taken through multiple interview rounds that built trust, then sent an "extremely generous" job-offer document. Opening the file on a corporate device installed spyware, giving the attackers a foothold.
From that workstation they moved laterally through Sky Mavis's internal systems and obtained the private keys for four of the nine Ronin validator nodes Sky Mavis controlled. A withdrawal needed five of nine signatures. The fifth came not from a fresh compromise but from operational debt: in November 2021 the Axie DAO had allowlisted Sky Mavis to sign transactions on its behalf during a player-onboarding surge; the program ended in December 2021 but the allowlist was never revoked.
With internal access, the attackers used Sky Mavis's gas-free RPC node to produce the Axie DAO validator's signature, reaching the five-of-nine quorum. They then signed two fraudulent withdrawal transactions. Because the transfers carried valid signatures and no withdrawal-limit or anomaly monitoring existed, nothing flagged the drain for six days.
Lure: a flattering, high-paying job offer from a plausible-looking employer, delivered over LinkedIn after several convincing interview rounds and finalized in an official-looking offer PDF. Tells: an unsolicited recruiter approach that escalates unusually fast to a "too good to be true" compensation package; a hiring process that asks you to open or run a file (offer, take-home task, contract) on a work device; a prospective employer whose corporate footprint is thin or unverifiable.
The core defensive instinct: never open recruiting attachments on a device with production or privileged access, and verify any employer independently before engaging.
The largest DeFi/crypto theft on record at the time. Funds were consolidated and laundered, substantially through Tornado Cash (which OFAC itself sanctioned on August 8, 2022, citing the Ronin laundering). Sky Mavis fully reimbursed affected users through treasury reserves and a $150M raise led by Binance, relaunched the bridge in June 2022 with an expanded validator set, a circuit-breaker system requiring higher signature thresholds and human review on large withdrawals, and daily withdrawal limits, and committed to becoming a "zero-trust organization." The engineer no longer works at the company.
The incident became the canonical example of Lazarus's fake-job-offer playbook against crypto engineers.
It shows that the weakest link in even a heavily engineered crypto system is often a single human on a professional networking site, not a smart-contract bug. A multi-week, fully staged fake interview is designed to defeat normal judgment, and the payload rode in on the most routine artifact of hiring: an offer document. It also demonstrates the compounding danger of stale privileges (an un-revoked allowlist) turning a nominally decentralized 5-of-9 quorum into a single-company single point of failure, and the cost of having no monitoring on high-value transactions.
The pattern recurred against other crypto firms (Atomic Wallet, WazirX, and others), making it a durable teaching case.
Treat unsolicited recruiter outreach and any hiring attachment as untrusted; open offers/take-home files only in isolated, sandboxed, non-privileged environments, never on devices with production or key-management access. Independently verify prospective employers (registered entity, real staff, corroborated presence) before deep engagement. Segment and apply least privilege so a single compromised workstation cannot reach signing keys; store validator/private keys in HSMs or hardware wallets requiring separate approval.
Enforce genuine multi-party, multi-organization key custody so no single company holds a quorum. Audit and expire delegated permissions and allowlists on a schedule; revoke temporary access automatically. Add withdrawal limits, human approval for large transfers, and real-time anomaly monitoring so a drain is caught in minutes, not days. Run ongoing social-engineering awareness training focused on the fake-job-offer lure.
Social Engineering Examples. “Axie Infinity / Ronin Bridge Heist: A Fake LinkedIn Job Offer That Cost ~$600M”. Accessed 19 September 2026. https://socialengineeringexamples.com/axie-infinity-ronin-bridge-linkedin-job-offer-heist-2022
Lazarus operators are documented (per Sky Mavis's own postmortem and subsequent reporting) as researching Sky Mavis staff, likely via LinkedIn and other public professional-networking data, to identify engineers plausibly holding privileged access to Ronin's validator infrastructure.
employee-facing OSINT exposure on LinkedIn (names, roles, org structure) is very hard to eliminate at enterprise scale; the realistic control assumes attackers already have this and hardens the hiring process it later gets used against, rather than trying to suppress public profiles.
the operators built out a fake recruiting identity, a company that did not exist, complete with enough of a plausible corporate veneer to survive a target's cursory checks during outreach.
independently verify any unfamiliar prospective employer before engaging further, checking for a registered business entity, real and checkable staff, and a corroborated public footprint beyond a LinkedIn page.
posing as recruiters, the attackers approached multiple Sky Mavis employees on LinkedIn and encouraged them to apply; one senior engineer was taken through several rounds of fake interviews designed to build trust and a sense of reciprocity before the payload was introduced.
treat unsolicited recruiter outreach that escalates unusually fast toward a "too good to be true" offer as a red flag, reinforced by ongoing social-engineering awareness training that specifically covers the fake-job-offer pattern.
the operators sent the engineer an "extremely generous" job-offer document, reported as a PDF or Word file, engineered to carry spyware that would execute when opened.
file-borne payloads delivered through personal channels like LinkedIn DMs largely bypass corporate email security controls, so this stage has no strong standalone defense; the practical control sits at Stage 5, restricting where such files can ever be opened.
the engineer opened the offer file on a corporate device, the spyware installed, and the attackers gained a foothold on a Sky Mavis workstation.
require that any recruiting or hiring-related attachment be opened only in an isolated, sandboxed, non-privileged environment (for example a disposable VM or non-corporate device), never on a workstation with access to production systems or key material.
from that compromised workstation the attackers moved through Sky Mavis's internal systems and obtained the private keys for four of the nine Ronin validator nodes Sky Mavis directly controlled, one short of the five-of-nine signature quorum needed to move funds.
apply network segmentation and least-privilege access so that compromising a single end-user workstation cannot reach validator keys or other sensitive infrastructure; require separate, hardware-backed authentication for systems with signing authority.
the attackers exploited an unrelated operational gap, an Axie DAO allowlist granted to Sky Mavis in November 2021 for a gas-free RPC arrangement that was never revoked after the underlying need ended in December 2021, to obtain the fifth validator signature without compromising the Axie DAO's own key.
audit delegated permissions and allowlists on a recurring schedule and expire them automatically when the underlying business need ends, and require genuine independent multi-party key custody across separate organizations so no single company's compromise can reach quorum.
with five of nine signatures in hand, the attackers forged and submitted two fraudulent withdrawal transactions, draining 173,600 ETH and 25.5 million USDC from the Ronin bridge; because no withdrawal-limit or anomaly-monitoring controls existed, the theft went undetected for six days.
enforce withdrawal limits, tiered signature thresholds with mandatory human review above set value thresholds, and real-time anomaly monitoring on high-value transaction systems so a fraudulent drain is flagged within minutes rather than sitting undetected for days.
the stolen assets were moved through decentralized exchanges to avoid centralized AML/KYC checks, then substantially funneled through the Tornado Cash mixer (with some early attempts at centralized exchanges), converting the on-chain theft into usable proceeds consistent with reported DPRK state revenue-generation objectives.
blockchain-forensics tracing and exchange/mixer AML-KYC controls, including the kind of sanctions action OFAC later took against Tornado Cash, can freeze or deter laundering in progress, though a well-resourced nation-state actor can still move a portion of funds before full interdiction.
Browse by what this case has in common with others in the library.
A Lapsus$ affiliate bought a contractor's stolen Uber password, flooded them with MFA push prompts, then posed as Uber IT…
A smishing text plus a follow-up phone call using a deepfaked colleague's voice tricked a Retool employee into surrendering MFA…
Attackers hijacked the New Haven school COO's email, quietly monitored a real $5.9M bus-contract payment thread.
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
Scheme participants posed as veteran finance professionals inside private WhatsApp investment groups to lure at least 18 U.S. retail investors…
A US Attorney's Office (EDVA) court order seized seven domains spoofing the Singapore International Monetary Exchange that pig-butchering scammers used.
The FBI's 2025 Internet Crime Report introduced its first dedicated AI-fraud tracking category, logging $893 million in losses.
A Houston- and California-based ring spoofed business emails to trick five companies and a New Jersey township into wiring over…
A Singaporean businessman transferred at least S$4.9 million after WhatsApp and email lures citing the Strait of Hormuz crisis drew…
A 16-member Colombian crime ring called and WhatsApp-messaged bank customers posing as fraud-prevention officers.
A suspected Chinese state-sponsored group jailbroke Anthropic's Claude Code by role-playing a "defensive security" pretext and used it to autonomously…
Google's GTIG and Ukraine's CERT-UA documented PROMPTSTEAL (aka LAMEHUG).
Two New Jersey men ran US "laptop farms" and shell companies that let North Korean IT workers pose as American…
A compromised Constant Contact account let Russia-linked Nobelium send USAID-spoofed phishing emails to 150-350 government and NGO organizations.
Chinese state-linked hackers used spear-phishing links and an unpatched Internet Explorer zero-day to breach Google, Adobe.
North Korean operators spear-phished Sony Pictures staff with fake Apple ID "verify your account" emails, harvested reused credentials.
KnowBe4 unknowingly hired a North Korean operative for a software engineering role after he passed four video interviews using an…
Social Engineering Examples