Social Engineering Attacks on Crypto Multisig Signers

By the Guardian team Updated November 2026 6 min read

Quick answer. Attackers pose as investors, recruiters or contractors, build trust, then get a signer to run malware or sign a disguised transaction. Stop it with dedicated signing devices, out-of-band checks, drills, and alerts on every queued transaction.

Watch: Social Engineering Attacks on Crypto Multisig Signers 1:43

Video transcript

Drift, Radiant, Ronin and Bybit share a pattern. Attackers targeted the people and devices around the signature, not the contract.

Drift lost about 285 million dollars after attackers posed as a trading firm for months. At least two council members signed transactions they did not fully understand.

Five patterns recur. Long cons, files from trusted contacts, fake job offers, malicious meeting links, and compromised tools.

Train signers to stop at unexpected links or files, unfamiliar call domains, script requests, or remote control requests.

Assume a lure will land, and make sure it lands on a machine that cannot sign. Email, chat and meetings belong on another device.

Radiant says its checks showed no obvious discrepancies. A check on a compromised machine inherits the compromise. Verify on a channel and device the attacker does not control.

Monitoring catches what training misses. Alert on every queued transaction, and add a timelock so alerts have time to matter. Drift's council had none.

If a lure may have worked, stop signing and warn other signers. Isolate the device, replace the signer from a fresh hardware wallet, and report it.

Guardian's OpSec Audit, led by Carlos Polop's offchain team, tests what signers see, whether a malicious payload slips past, and whether runbooks hold up.

After launch, Managed Security reviews every multisig transaction before signing. Read the full guide, or talk to Guardian.

Drift's loss of about $285 million in April 2026 started at crypto conferences, months before anyone signed anything.

Radiant, Ronin and Bybit followed the same path. The attackers went after the people and devices around the signature, not the contract.

This guide covers how signers are targeted, and how to verify, detect and respond. For the signing policy itself, see multisig best practices.

How Signers Get Targeted

Five patterns recur in the public cases:

Pattern	Case	What happened
The long con	Drift, April 2026	A fake trading firm met contributors for months
The trusted contact	Radiant, October 2024	A fake ex-contractor sent a zipped PDF on Telegram
The fake job offer	Ronin, March 2022	An offer letter PDF carried spyware
The malicious meeting	ELUSIVE COMET, 2025	Fake interviewers asked for Zoom remote control
The compromised tool	Bybit, February 2025	A breached Safe{Wallet} laptop led to a disguised transaction

The long con

Per Chainalysis, citing Drift's investigation, the attackers posed as a quantitative trading firm and approached contributors at major crypto conferences.

They onboarded a vault, deposited over $1 million and joined strategy discussions. At least two council members then signed transactions they did not fully understand. Our Drift write-up covers the mechanics.

The trusted contact

On September 11, 2024, a Radiant developer got a Telegram message that appeared to come from a former contractor, asking for feedback on a zipped PDF.

It carried INLETDRIFT, a macOS backdoor, and spread as the file was shared with colleagues. Radiant says front ends showed benign data while malicious transactions were signed in the background.

Mandiant attributed the roughly $50 million October theft to a North Korea-linked group.

The fake job offer

A senior Axie Infinity engineer went through several rounds of interviews with a company that did not exist, The Block reported. The offer arrived as a PDF carrying spyware.

Attackers reached four of Ronin's nine validator keys and used a stale DAO permission for the fifth. The Block put the loss at about $540 million.

The malicious meeting

SEAL describes North Korean actors posing as trusted contacts, such as investors, and sending call links on unfamiliar domains. The page shows an "error" whose fix installs malware.

In a case Huntress published in June 2025, a crypto foundation employee joined a Zoom call with deepfakes of senior leaders. The employee was told to install a "Zoom extension".

ELUSIVE COMET poses as journalists and investors, pushes victims to share their full screen, then requests remote control. Trail of Bits' CEO was targeted through fake Bloomberg Crypto invitations.

The compromised tool

Sometimes the target is the tool signers trust. Per Safe{Wallet}, a compromised developer machine led to a disguised malicious transaction being proposed to Bybit's Safe.

The FBI attributes the roughly $1.5 billion theft to North Korea.

In July 2024, WazirX reported a mismatch between what Liminal's interface displayed and the transaction signed, with over $230 million lost. Liminal says a Grant Thornton review of its web application found no evidence of compromise.

Red Flags to Train On

Train signers to stop at any of these:

Unexpected links or attachments, even from a known contact.
A call link on an unfamiliar domain, or an "error" you are asked to fix.
A request to run a script to make a call work.
A request to share your full screen or grant remote control.

Fake job and investment offers have their own FBI red flags, listed in our crypto OpSec baseline.

Harden the Signer

Assume one of these lures will land. The aim is that it lands on a machine that cannot sign.

A dedicated signing device with minimal software, used for nothing else.
A clean restart before each use, and offline storage between uses.
Email, chat, meetings and documents on a different device.
Transaction links never clicked, even from trusted parties. Use bookmarks.

Hardware keys, Zoom settings and rules for coding tests are in the same OpSec baseline.

Verify Out of Band

Radiant simulated in Tenderly, verified payload data and followed its procedures. It says checks and simulations showed "no obvious discrepancies".

A check run on a compromised machine inherits the compromise. Verify on a channel and a device the attacker does not control.

Verify the person

Confirm identity on a channel you choose, such as a video call on another app.
Verify Signal safety numbers by calling on another channel.
Agree code words for urgent requests.

Verify the transaction

Decode it on the hardware wallet and a clean second machine, not the proposing browser.
For high-value transfers, read the address character by character on a video call.
Have a second reviewer check the decoded payload before the last signature.

If a signer's chat account is taken over, SEAL says to cancel any pending transaction requested through it.

Detect and Escalate

Training lowers the odds. Monitoring catches what gets through.

Alert on every queued transaction, decoded, in a channel signers watch. A timelock gives that alert time to matter: Drift's council had none.

The full alert list and compromise runbook are in our signer policy.

Escalation

SEAL treats phishing aimed at multisig operations as a report-now incident, and asks for near misses too.

If a lure may have worked, such as a file opened or a screen shared:

Stop signing, and alert the other signers on a backup channel.
Isolate the device.
Replace the signer from a fresh hardware wallet.

For outside help, SEAL 911 takes reports on Telegram at @seal_911_bot.

Training, Drills and Red Teams

SEAL's awareness framework favors short, role-based sessions on a recurring schedule. Signers need their own track.

Case reviews: walk through Drift, Radiant and Bybit, and ask where each signer would have stopped.
Simulated lures: phishing simulations with immediate feedback, including fake investor calls and contractor files.
Emergency drills: page every signer and run a pause or rotation.
Tabletops: a hijacked signer chat account, or a contractor file that ran on a signer's laptop.
Red teams: third-party tests of staff resistance to social engineering, as SEAL's checklist recommends.

Measure reporting, not just clicks. SEAL suggests tracking reporting rates, and Trail of Bits recommends rapid, blame-free reporting of suspicious contacts.

How Guardian Helps

Guardian's OpSec Audit reviews multisig signing: what a signer sees before approving, and what it takes to slip a malicious payload past them.

It also checks whether incident runbooks hold up. Guardian's offchain services are led by Carlos Polop, creator of HackTricks.

After launch, Managed Security monitors multisig transactions, privileged calls and role changes on every block. Its security operations team reviews every multisig transaction before it is signed.

Frequently Asked Questions

How do hackers social engineer multisig signers?

They build trust first, posing as investors, recruiters, contractors or journalists, sometimes for months. Then they get a signer to open a file, install fake meeting software or approve a transaction that differs from what the screen shows.

How were Drift's signers social engineered?

Chainalysis says attackers posed as a quantitative trading firm and met contributors at conferences. They kept in contact for about six months and deposited over $1 million. At least two council members signed transactions they did not fully understand.

What is ELUSIVE COMET?

A threat actor that impersonates journalists, podcast hosts and investors to get crypto holders onto Zoom calls. It pushes them to share their full screen, then requests remote control and installs malware. SEAL advises turning Zoom remote control off.

What should a signer do after a suspicious contact?

Report it, even if nothing happened. If a file ran or a screen was shared, stop signing and alert the other signers on a backup channel. Then isolate the device and replace the key from a fresh hardware wallet.

Sources

Check what your signers would approve

Guardian's security operations team reviews every multisig transaction before it is signed, against a live threat model of every path to your funds.

Talk to Guardian Explore Managed Security