Web3 Projects Targeted by Sophisticated IT Impersonators

Cybercriminals posing as IT professionals have drained approximately $1 million from multiple NFT protocols through coordinated attacks, according to blockchain investigator ZackXBT. The scams targeted Web3 platforms including fan-token marketplace Favrr and NFT projects Replicandy and ChainSaw between June 20-26, 2025.

Exploit Mechanics Revealed

The attackers manipulated NFT minting functions to create large quantities of digital assets, then rapidly sold them to crash market prices. 【ChainSaw's floor price dropped to zero】 during the attack, while Favrr saw its native token value plummet by 82% within hours. ZackXBT's on-chain analysis shows the stolen funds were laundered through multiple exchanges and nested wallet services.

Remote Work Vulnerabilities Exploited

——The attacks highlight growing security risks in decentralized organizations—— where remote collaboration makes identity verification challenging. Hackers reportedly gained access by exploiting trust in IT support channels, a tactic that's become increasingly common since 2023 according to cybersecurity firm Halborn.

North Korean Connections Suspected

The fund movement patterns resemble previous attacks by state-sponsored groups like Lazarus Group. In November 2024, similar methods were used against US defense contractors by North Korean operatives known as "Ruby Sleet." Blockchain analytics show portions of the stolen assets were converted to privacy coins Monero and Zcash.

Industry-Wide Security Concerns

This incident follows May 2025's Coinbase data breach, where 【69,461 users】 had personal information stolen through compromised customer service accounts. The parallel attacks suggest organized groups are systematically targeting crypto platforms through social engineering rather than technical exploits alone.

Protective Measures Recommended

Security experts advise Web3 projects to implement: • Multi-signature wallet approvals • Time-delayed transaction mechanisms • Mandatory video verification for IT personnel ZackXBT's full forensic report is expected to be released on June 30 through his Patreon channel.