Blockchain investigator ZackXBT has uncovered a disturbing new wave of crypto thefts involving fraudsters posing as internal IT staff. According to ZackXBT’s latest findings, these attackers have stolen over $1 million by targeting employees of NFT protocols and Web3 companies, exploiting the vulnerabilities that come with remote work environments.

How the Attacks Work

The scammers approach employees through internal communication tools like Slack, Discord, and email, impersonating IT team members or security support. They often fabricate urgent scenarios — such as needing to update security software or resolve a technical issue — to trick employees into granting access or sharing sensitive credentials.

Once inside the company’s systems, the attackers move quickly: stealing wallet private keys, accessing admin dashboards, or initiating unauthorized crypto transfers. The funds are typically funneled through mixers or cross-chain bridges to obscure their trail, making recovery difficult.

Why Remote Work Makes These Attacks Easier

The shift to remote and hybrid work has expanded the attack surface for Web3 firms. Without in-person verification, employees are more vulnerable to convincing social engineering tactics. Many firms rely heavily on digital communication, and with distributed teams across multiple time zones, it becomes harder to verify whether a message or request is legitimate.

Moreover, smaller NFT protocols and startups often lack the robust IT and cybersecurity infrastructure of larger tech companies, making them easier targets for these impersonation scams.

Wider Impact and Industry Lessons

These attacks highlight a critical security gap in the Web3 sector: human vulnerability. Unlike smart contract exploits or protocol bugs, these thefts succeed because the attacker deceives employees, not machines.

To counter these threats, experts advise Web3 firms to:

• Implement strict internal verification processes for IT or security-related communications.

• Enforce multi-factor authentication (MFA) for all administrative accounts.

• Provide regular employee training on spotting and reporting social engineering attempts.

• Adopt zero-trust security frameworks that treat all internal access as potentially risky.

The Road Ahead

As the Web3 ecosystem continues to grow, these incidents serve as a wake-up call. Strengthening internal security practices is no longer optional — it’s essential for protecting assets, reputations, and user trust in the decentralized economy.