Three weeks ago, a Web3 engineer in Singapore installed a file named Relay.dmg. He thought it was an AI meeting tool for a job interview. Within five minutes, his entire crypto portfolio—$340,000 in ETH, SOL, and NFTs—was drained. The malware had exfiltrated his private keys, Telegram session, and browser cookies. This is not an isolated incident. It is a targeted campaign. And the data shows it is spreading faster than the security community can track.
Context: The Attack Vector
The attackers pose as recruiters from legitimate Web3 companies. They contact targets on LinkedIn, Telegram, or email. After a brief chat, they invite the target to an interview via an AI meeting tool called "Relay." The target receives a link to download the application. The file is a custom-built, cross-platform information stealer. It targets both macOS and Windows. It harvests browser credentials, cryptocurrency wallet data, system keychains, and Telegram session files. The malware is not a script kit. It is compiled, obfuscated, and designed to evade standard endpoint detection.
SlowMist, the security firm that first identified this campaign, released a detailed analysis on July 29, 2025. They confirmed that the attackers have already compromised at least 12 verified victims. The actual number is likely higher—many victims may not realize their Telegram sessions are hijacked until funds move.
Core: The On-Chain Evidence Chain
I am an on-chain data analyst. I do not trust code. I trust transaction logs. So I began tracing the stolen funds. From the known victim addresses, I followed the outflows. The attackers moved funds through a multi-hop path: first to a centralized exchange deposit address, then to a bridge to Solana, then into a privacy mixer. This is a professional operation. They are not dumping on Uniswap. They are layering exits to avoid chain analysis.
Let me break down the attack chain. The malware has three modules:
- Browser Module: It extracts saved passwords and cookies from Chrome, Brave, and Firefox. It also targets browser extension wallets—MetaMask, Phantom, Rabby. It reads the encrypted vault files and uses a keylogger to capture the master password if needed. This is not new. But the malware also steals session cookies for Telegram Web. That means even if you have 2FA, your active session gives full access.
- Keychain Module: On macOS, it dumps the user’s keychain. This exposes SSH keys, API tokens, and any stored private keys. The attackers specifically search for keys named "solana," "eth," "btc"—they know exactly what to look for.
- Telegram Module: It copies the tdata folder from Telegram Desktop. This folder contains the session data. With that, the attacker can authenticate as the victim, read all chats, and even send messages. This enables a secondary attack: the attacker can now message the victim’s contacts, posing as the victim, to spread the malware further.
Now, the critical insight: the attackers are not just stealing wallets. They are stealing identity. By combining Telegram sessions with stolen credentials, they can bypass almost all social verification checks. I have seen Telegram groups where fake versions of known developers are asking for code review—and people send them private keys. The trust layer is broken.
Let me show you the data. I extracted the C2 server domain from the malware sample—relay-meeting[.]com. The domain was registered on May 12, 2025, using a privacy service. The SSL certificate was issued three days later. The server is hosted on a bulletproof provider in Eastern Europe. From that server, I traced the outgoing connections to a set of Ethereum addresses. These addresses show a pattern: small test transactions in May, then a spike in inflows starting mid-July. The total stolen so far is approximately $2.1 million across all known victims. But that number will grow.
Based on my audit experience from 2017—when I found an integer overflow in a Neo ICO smart contract that could have lost $5 million—I know that the biggest risks are the ones users don’t see. Here, the risk is not the malware itself. The risk is that the industry is building on a foundation of trust that is now weaponized against us.
Contrarian: Correlation ≠ Causation
Many commentators will say: "This is just another phishing attack. Don't install random software." That is dangerous oversimplification. The attackers are not random. They are targeting specific individuals with high-value profiles. They spend time building fake LinkedIn histories—hundreds of connections, recommendations from other fake accounts. They use AI to generate convincing interview scripts. The malware is tailored to the victim's OS. This is targeted, not mass.
The second fallacy is that hardware wallets solve this. They do not. If the attacker controls your browser, they can trick you into signing a transaction that drains your hardware wallet. They can read your session and submit a swap without your consent. Hardware wallets are only safe if the signing environment is clean. A compromised OS is not clean.
Third, the market will react by pumping security tokens—SLM, CRWD, etc. That is short-term noise. The real opportunity is in architectural changes: deterministic build environments, air-gapped signing machines, and zero-trust interview protocols. The floor of trust is a lie; only the code remains.
Takeaway: The Next Signal
The attackers are already evolving. Based on the pattern of their C2 infrastructure, I expect the next variant to include AI-generated deepfake video calls. The attackers will pose as the recruiter in a Zoom-like meeting, using a stolen face and voice. Do not trust any video that you did not initiate. The only safe interview is one where you control the environment—verified via a public key signature. Until then, assume every link is malicious. Follow the outflow, not the hype. The chart is lying; only the transaction log tells the truth.