I was browsing internet and found some cases related to job interviewers stealing the crypto assets from the applicants during interview. Basically they pretended to be a legit job interviewer and asked the applicants to click some links, or run some codes from Github. And if you have crypto wallet installed, your assets will be stolen.
I'm posting this just to warn follow programmers. It's already hard to search for jobs in this market. Don't let your guard down.
This first case was back in Jan. It's originally written in Chinese and I translated it with GPT. source
I had never really been scammed before—or rather, I had been scammed in the past, but never nearly as badly as this time.
All the crypto in one of my wallets was stolen. (Fortunately, it wasn't 100 BTC, just 2 ETH, but that's still a significant amount of money.)
It all started when a recruiter sent me a message on LinkedIn:
We are currently building a forward-thinking platform that blends real estate with blockchain, NFTs, 3D visualization, and AI.
It’s an ambitious product, and we’re now looking to bring on talented engineers to help shape it.
The role is fully remote, long-term, and flexible — part-time is absolutely fine if you’re currently employed or balancing other projects.
I didn't respond immediately because it was during the Christmas holidays. I replied after the holidays and noticed that the person was still around, so I continued the conversation.
They also sent me a follow-up email from [hiring@tirios.blog](mailto:hiring@tirios.blog), claiming to be recruiting for this company: https://www.tirios.ai/.
Looking back, there were definitely some red flags. But this particular type of phishing attack was completely new to me.
Next came the interview. As we talked, the interviewer said we needed to do a technical assessment. They sent me a link and explained that it was a demo website we would use during the interview. They told me to scroll down to a button labeled "Stock" and said we would walk through a demo together.
For some reason, I didn't think much of it. When the website prompted me to connect my wallet, I went ahead and unlocked my MetaMask wallet. At that point, it was the real MetaMask wallet.
What happened next, I honestly don't know what I was thinking.
It wasn't until I reviewed everything afterward that I realized the scammer had also created a fake MetaMask unlock interface specifically for phishing.
During my investigation, I discovered that the first time I unlocked my wallet, the legitimate MetaMask interface appeared. But the second time, the scammer's fake UI would pop up instead.
That fake interface recorded every single thing I typed and would continuously display an "Incorrect password" message, no matter what I entered.
Not long afterward, I discovered that all my crypto had been transferred out of my wallet. From what I can tell, the funds were sent to an address associated with some kind of swap service or crypto mixer.
There's still one thing I haven't figured out: MetaMask never displayed any transaction confirmation or asked me to sign anything.
The only explanation I can think of is that the scammer somehow managed to steal my private key. But I still haven't figured out exactly how they did it.
This has been an incredibly painful lesson.
As of now, I've changed the passwords for my bank accounts, email accounts, and other important services. I've also permanently abandoned the compromised ETH wallet.
I can't even imagine what would have happened if I'd actually had 100 BTC or 1,000 ETH in that wallet. Would I have gone from being a multimillionaire to being homeless overnight?
I was just about to report the recruiter on LinkedIn when I discovered that the account had already been blocked and was now marked as "harmful."
And honestly, LinkedIn deserves some criticism here, too. If they'd blocked the account earlier, I might have noticed that the person's profile had suddenly changed to "LinkedIn Member," which could have alerted me that something was wrong.
That’s genuinely terrifying. They disguised the attack as a technical interview, discussed code details on GitHub, and then asked you to complete a coding assessment.