A critical scam is circulating within the blockchain developer community, especially on LinkedIn. This scam preys on individuals by posing as industry recruiters Or as just freelance developers, and startup founders, offering high-paying roles.

How to recognize them

They communicate mainly through text and hire you even without an interview.
They ask you to collaborate on their project and give you the codebase to work with.
Offer very high compensation for your work, mostly on an hourly basis.

How the Scam Operates:

Either they give you the Github repo or the code file.
They ask you to clone it on your system and do some sample tasks “to show that you can work with it ".
You clone the repository to your computer and start working on the task. During this process, you might encounter permission requests, including access to MetaMask or other personal data. It's crucial to be cautious and deny these requests.
Even after denying these permissions, there is a chance of loss of funds from your crypto wallets.

How Did This Happen Despite Denying Permissions?

The rogue repository contains a npm package called "child_process": "^1.0.2". When executed, it gains access to your private key stored in any ".env" file on your computer. Even if the file is in a separate directory, Node.js, with its file system access, can inadvertently expose sensitive information.

What caused the hack?

Many blockchain developers use environment files (.env) to store private keys or mnemonic phrases for deploying or testing smart contracts. While the best practice is to use freshly generated accounts with only Testnet funds, errors can occur. Sometimes, developers accidentally transfer real (mainnet) funds into these accounts. As private keys remain consistent across different chains, scammers exploit this vulnerability to drain funds from your wallets.

Photo Credit: UpNorthLive.com