Crypto Scams on LinkedIn: Fake Recruiters and Investment Pitches

Crypto scams on LinkedIn mostly take two forms: fake recruiters who use a hiring process to get you to run malware or hand over access, and fake professionals who build trust before pitching an investment platform that steals your deposits. Both rely on LinkedIn's professional atmosphere, which makes people lower their guard.

These scams target crypto employees, developers and job seekers in particular, because their computers often hold wallet keys or access to company systems. Ordinary investors are targeted too, through "networking" that slowly turns into a pitch. Knowing the script makes the warning signs easy to spot.

How the Fake Recruiter Scam Works

Security researchers and law enforcement agencies have publicly warned that some well-resourced hacking groups, including state-linked ones, use fake recruiter personas to target crypto workers. The pattern is usually:

1. 1The approach. A recruiter with a convincing profile messages you about a well-paid role at a crypto firm, sometimes using the name of a real company.
2. 2The move off-platform. You are moved to Telegram, Discord or personal email "for speed."
3. 3The interview. One or more short calls make it feel real.
4. 4The payload. You receive a take-home coding challenge to clone and run, or you are told to install a specific video-call app or "browser update" to join an interview.
5. 5The theft. Running the code or software installs malware that searches for wallet files, browser extensions, saved passwords and session cookies, then quietly sends them to the attacker.

Our deeper guide on malware in fake crypto job coding tests explains how these repositories hide malicious code. See also: Fake Crypto Charity and Disaster Donation Scams.

How the Investment Pitch Scam Works

The second pattern looks like normal networking:

1. 1A contact with an impressive title, often in finance, connects and starts friendly conversations.
2. 2Over days or weeks they mention their side income from crypto trading, sometimes with screenshots.
3. 3They offer to "mentor" you and recommend a specific platform or app.
4. 4Small first deposits show strong gains, and you might even be allowed one small withdrawal.
5. 5Larger deposits are encouraged; then withdrawals are blocked by "taxes," "verification fees" or "account upgrades."

This is a version of what is often called a pig-butchering scam. Related reading: Scammers Impersonating Regulators and Police in Crypto.

A Composite Example (Hypothetical)

The following is a made-up scenario that combines common features; it is not a real case.

Imagine "Sam," a smart-contract developer, receives a LinkedIn message from a recruiter at a well-known exchange offering a senior role. After a pleasant 20-minute call, Sam is sent a GitHub repository and asked to "fix a small bug and run the tests." The project installs dependencies, one of which contains an obfuscated script. Within hours, funds disappear from a browser wallet on Sam's laptop, and the attacker uses a saved session to log into Sam's work account. The recruiter's profile is deleted the next day. If you want to go further, read Fake Browser Update and Captcha Malware Targeting Crypto Users.

Warning Signs Checklist

• The role is not listed on the company's official careers page.
• The recruiter's profile is new, has few posts or uses a stock-like photo.
• You are rushed off LinkedIn to another messaging app.
• You are asked to run code, install software or use a "special" meeting link.
• The test requires connecting a wallet or signing a transaction.
• A new contact brings up crypto profits unprompted.
• Someone recommends a trading platform you have never heard of.
• Returns are described as guaranteed or "low risk, high yield."

How to Protect Yourself

• Verify independently. Find the company's website yourself and contact HR through it to confirm the role and the recruiter.
• Isolate technical tests. If you must review code, do it in a disposable virtual machine or cloud environment with no wallets, passwords or work logins.
• Keep keys off your daily computer. Use a hardware wallet for meaningful holdings so malware cannot simply copy keys.
• Use standard meeting tools only. Legitimate companies use widely known platforms that do not require obscure downloads.
• Check firms with regulators. Look up any investment platform on your national regulator's register and warning list.
• Lock down accounts. Use strong, unique passwords and app-based or hardware-key two-factor authentication. See our guide on social engineering in crypto for more.

What to Do If It Happened

1. 1Disconnect the affected device from the internet.
2. 2From a clean device, move funds from any wallet that was accessible on the compromised machine to a brand-new wallet with a new seed phrase.
3. 3Reset passwords and revoke sessions for email, exchanges and work accounts, starting with email.
4. 4Tell your employer's security team if any work systems could be affected.
5. 5Wipe and reinstall the device before using it again.
6. 6Report the profile to LinkedIn, file a report with local authorities, and report scam websites or tokens through our scam reporting page.

Our step-by-step checklist on what to do immediately if your wallet is compromised covers the urgent first hour. For what happens after a report, see how to report a crypto scam and what happens next.

Bottom line

LinkedIn scams work because they look like ordinary career and networking activity. The rule is simple: real employers do not need you to run unknown code on your main computer or connect a wallet, and real professionals do not pitch you secret trading platforms. Verify every role and firm through official channels, keep your keys on separate hardware, and act fast if something goes wrong.