Been seeing this quite often recently 👇
But the investments side.
You get a DM or sometimes even an intro from someone in your network.
It's an investor, VC, Family Office, etc .. , they look legit. Website looks solid. Team page. LinkedIn profiles. All checks out.
They ask you to book a call on their calendar, which, of course, isn’t Calendly or anything usual.
You book it, but the calendar invite has no meeting link, just a placeholder. If you ask, they'll just tell you: “we’ll send it on the day.”
And then the day comes, and they drop you a link that looks almost real:
⛔- kakaomeets .com instead of kakaocorp .com
⛔- zoom .us instead of zoom .com
⛔- microsoft.connect-meet .com instead of teams .microsoft .com
You click, you land on a legit-looking page, with a big shiny CTA: “download the app.”
You download it. You install it. And voila, you've been hacked.
We’ve been getting this at least once a week for the past couple of months. Luckily we’re not taking private investment, so we're not that excited about it, hence we had the time to DD each “investor.” But many builders fundraising right now don’t. They get excited too fast. And the amount of these scams is insane.
⚠️ Advice for every founder:
1⃣ - Don’t get too excited when an “investor” reaches out.
2⃣ - Always be the one to set up the calls.
3⃣ - If you can’t, verify the link or propose another on your side.
Quick Note:
Always go to GoDaddy WHOIS, paste the domain (everything from the .com/.us/etc. backwards), and see when it was registered. If it’s brand new → red flag.
These people will try every excuse in the book to hook you in:
“Our chairman doesn’t speak English, so we have to use this app.”
“We can’t use Google in our country, so let's use this one.” etc ..
Just, don’t fall for it.
As
@cz_binance says: Stay SAFU.
These North Korean hackers are advanced, creative and patient. I have seen/heard:
1. They pose as job candidates to try to get jobs in your company. This gives them a “foot in the door”. They especially like dev, security, finance positions.
2. They pose as employers and try to interview/offer your employees. During the interview, they will be a problem with Zoom and they will send your employee a link to an “update”, which contains virus that will takeover your employee’s device. Or they will give your employee a coding question and later send some “sample code”.
3. They pose as users and send you links in a Customer Support request. The linked page will have a virus to download of some kind.
4. They pay/bribe your employees, outsourced vendors for data access. Just a few months ago, a major India outsource service was hacked and leaked a major US exchange user data, resulting in user asset loss of more than $400m.
The list goes on…
To all crypto platforms, train your employees to not download files, and screen your candidates carefully.
Stay SAFU. 🙏