Skip to main content

Crypto Job Scam

· 3 min read
Milad

Excited about a Web3 dev job offer? Be cautious—scammers are targeting developers!

Table of Contents​

TL;DR To stay safe:

  1. use multi-signature wallets to store your digital assets
  2. never keep private-keys/mnemonics on your computer/cloud backup; only use pen/paper.
  3. have different browser profiles
  4. use a remote development environment like github code-spaces to run un-trusted code

How Do These Scams Work?​

1. Fake Job Offers​

Scammers post job listings claiming to need a developer for a React + Web3 integration.

They provide code and ask developers to run it locally!

VsCode recently introduced Workspace Trust that allows you to view code without allowing code execution to make it safe for you.

Will you run it locally?

Never trust someone you see on the Internet and definitely never run their code locally.

2. Malicious Frontend Code​

The provided code looks normal but may contain hidden scripts that interact with window.ethereum (the MetaMask API).

Some scripts inject malicious JavaScript that hijacks wallet interactions.

3. MetaMask Wallet Draining​

Users unknowingly sign a malicious transaction that grants attackers access to their wallet.

In some cases, the app may use XSS (Cross-Site Scripting) to inject unauthorized scripts.

If users mistakenly enter their private key or seed phrase into a fake prompt, their entire wallet gets drained.

Now that we’ve seen how fake job scams work, let’s break down how a compromised React app can actually steal your crypto.

How Can a React App Steal Crypto?​

Here are some common attack vectors:

1. Fake MetaMask Popups (Phishing UI)​

Scammers create fake MetaMask login popups that trick users into entering their seed phrase. Once entered, the attacker gains full access to the wallet.

2. Malicious Event Listeners​

If the frontend has access to window.ethereum, it can:

  • Request account access (eth_requestAccounts).
  • Trick users into signing malicious messages (personal_sign).
  • Auto-submit transactions granting token approvals to attackers.

3. XSS (Cross-Site Scripting) Attacks​

If the app has an XSS vulnerability, injected JavaScript can:

  • Modify UI elements to mislead users.
  • Intercept transactions before they are signed.
  • Redirect funds to attacker-controlled wallets.

4. Clipboard Hijacking​

Some malicious apps monitor clipboard activity and replace copied wallet addresses with the attacker's address when users try to send funds.

How to Protect Yourself​

tip

Just stay away from job postings that require you to: Just stay away from job postings that require urgency or running untrusted code.

✅ Never run untrusted code—even frontend-only applications can be dangerous.
✅ Inspect code carefully before executing anything, especially if it interacts with MetaMask. ✅ Use a separate browser profile for Web3 development. ✅ Disable clipboard access for unverified applications. ✅ Keep MetaMask updated to avoid known exploits. ✅ Check for injected scripts (open DevTools → Console → Look for unexpected network requests).

Final Thoughts​

If you're a Web3 developer, be extra cautious when applying for jobs online. If someone asks you to execute their code, thoroughly review it first. A single malicious transaction or phishing attempt could result in losing your entire crypto portfolio.

Always use multi-signature wallets to protect assets you cannot afford to lose.