On the morning of July 29, a security disclosure from SlowMist landed in my inbox. It was not another liquidity pool hack or a governance exploit. It was something quieter, more surgical: a fake AI interview tool named 'Relay' that, once installed, systematically exfiltrates browser credentials, encrypted wallet data, macOS keychains, and Telegram session files. The target? Web3 professionals—developers, analysts, fund managers like myself—anyone who holds the keys to digital assets.
I traced the static in the protocol’s genesis block, and what I found was not a code vulnerability but a rupture in human trust. The attackers posed as recruiters from a credible-sounding blockchain firm, sending meeting links that downloaded a malicious installer disguised as a legitimate AI-powered meeting scheduler. For a $100 billion industry built on cryptographic verifiability, the attack vector was embarrassingly analog: trust the person on the other side of the screen, run the .dmg or .exe, and watch your portfolio drain in silence.
Context: The Perfect Storm of Trust and Narrative Web3 recruitment has exploded in the 2025 bull market. With thousands of protocol teams hiring for roles from Solidity engineers to community managers, the line between legitimate outreach and phishing has blurred. The industry prides itself on decentralization, but the hiring process remains centralized on platforms like LinkedIn, Telegram, and Discord. Attackers have learned that the fastest way to a private key is not through a smart contract bug, but through the social contract of job interviews.
The use of AI as a narrative hook is particularly insidious. Since the release of GPT-based tools in 2023, the crypto industry has embraced AI with uncritical enthusiasm. “AI-powered” has become a stamp of legitimacy, even when the underlying technology is trivial. The attackers understood this. By naming their malware “Relay” and framing it as an AI meeting scheduler, they bypassed the skepticism that a simple “download this file to continue” would normally trigger. In the bull market euphoria, everyone is racing to hire and be hired. Caution becomes an afterthought.
Based on my experience auditing the Iconic Protocol’s crowdsale contract in 2017, I learned that social engineering is the most expensive bug of all. No amount of formal verification can protect a user who willingly runs a malicious binary. The real security perimeter is the user’s mental model.
Core: Anatomy of the Relay Malware — A Code-Level Dissection SlowMist’s sample analysis reveals a technically competent cross-platform information stealer. The malware exists in two variants: one for macOS (Mach-O binary) and one for Windows (PE executable). Both variants share a similar command-and-control (C2) infrastructure and data exfiltration logic, but adapt to each platform’s specific security mechanisms.
Attack Chain Stage 1: Social Engineering and Delivery - The attacker creates a fake LinkedIn profile, claiming to be a recruiter for a tier-1 venture-backed protocol (e.g., a zk-rollup or AI oracle project). - After exchanging a few messages, the “recruiter” sends a calendar invite with a link to download “Relay — AI Meeting Concierge v2.3”. The link points to a domain that closely mimics a legitimate meeting platform (e.g., relay-meet[.]com vs. relaycom[.]com). - The landing page presents a clean UI with a download button. No code audit, no VirusTotal scan needed—just a single click.
Stage 2: Payload Execution and Persistence - On macOS, the downloaded .dmg contains a .app bundle that requests permissions for Accessibility and Full Disk Access during installation. A prompt reads: “Relay needs access to your screen share settings to optimize meeting quality.” This is a standard permission prompt, and many users grant it without reading. - Once granted, the malware writes a launchdaemon plist to ~/Library/LaunchAgents/, ensuring it runs every time the user logs in. The macOS variant uses a technique similar to “osascript” to inject a persistence agent that survives reboots. - On Windows, the installer drops a DLL file in %APPDATA% and creates a scheduled task. It uses DLL sideloading to evade detection by hooking into legitimate processes like svchost.exe.
Stage 3: Data Harvesting The malware enumerates the following targets: - Browser credentials: Chrome, Firefox, Brave, Opera — stored passwords, cookies, and autofill data. It reads the browser’s SQLite databases (Login Data, Web Data) and decrypts them using the system’s keychain (macOS) or DPAPI (Windows). - Cryptocurrency wallet extensions: MetaMask, Phantom, Keplr, and others installed as browser plugins. The malware reads the extension’s local storage files, which often contain encrypted wallet seeds or private key materials. While modern wallets encrypt local data with a password, many users do not set one, or the encryption is weak. - Keychain/credential manager: On macOS, the malware uses the security command-line tool to dump generic passwords stored in the user’s login keychain. This includes VPN credentials, application passwords, and sometimes wallet passphrases if the user saved them. - Telegram session files: The malware copies the tdata folder from Telegram Desktop, including session keys and cached messages. With access to a live Telegram session, the attacker can impersonate the victim, send malicious links to the victim’s contacts, and escalate the attack to peer networks. - System info: User name, hostname, IP address, running processes — used to fingerprint the victim and prioritize high-value targets.
Stage 4: Exfiltration and Cover-Up The collected data is compressed into a .zip file, encrypted with a hardcoded AES key, and sent to the C2 server via HTTPS POST request. The malware also attempts to delete its own installer and any logs that might indicate its presence. However, traces remain in system logs (e.g., Unified Logs on macOS, Event Viewer on Windows).
Technical Originality and Threat Evolution What makes Relay stand out is not the theft technique itself—keyloggers and info-stealers have existed for decades—but the precision targeting and the narrative wrapper. The attackers clearly understood the Web3 community’s cultural markers: the excitement around AI, the remote-first nature of work, and the trust-based relationships that define the industry.
During my 2022 Terra collapse crisis work, I witnessed how quickly panic spreads when trust in foundational systems erodes. Relay aims to erode trust not in a protocol, but in the very process of human connection. The malware is a reminder that every bug is a story the system tried to hide. In this case, the story is that our social graph is as vulnerable as our smart contracts.
Why This Attack Succeeds Where Others Fail - Narrative alignment: The AI narrative is currently the most powerful memetic vector in crypto. Attackers piggybacked on it to lower the target’s guard. - Platform blind spots: LinkedIn and Telegram have minimal automated detection for malware distribution through DMs. Attackers know that reporting takes hours, and by then, the damage is done. - Cross-platform coverage: Many Web3 professionals use macOS (developers) and Windows (non-tech roles). Writing a stealer for both platforms widens the attack surface. - Credential reuse: Even if the wallet itself is protected, the same password often secures the email account that can reset the wallet password.
Contrarian: The Blind Spots We Choose to Ignore The initial reaction to the Relay disclosure will be a wave of security bulletins: “Check your downloaded applications,” “Use hardware wallets,” “Enable 2FA.” All valid advice. But the contrarian truth is that the real vulnerability lies in the industry’s reliance on centralized identity verification. We expect users to verify every file hash, but we offer them no decentralized alternative to the hiring process.
Consider this: The attackers did not need to exploit a zero-day in a smart contract. They exploited the absence of a decentralized identity (DID) standard for professional interactions. If every job offer came with a verifiable credential signed by the protocol’s governance multisig, Relay would have been detected immediately. But today, we trust a LinkedIn profile picture and a few mutual connections. That is the blind spot.
Furthermore, the focus on user education alone is insufficient. The attackers will adapt. The next version of Relay may include deepfake audio to simulate a recruiter’s voice, or exploit browser zero-days to install without user interaction. The industry’s response must shift from post-facto warnings to proactive infrastructure: mandatory hardware-backed device attestation for sensitive sessions, and runtime memory encryption for wallet extensions.
Another blind spot is the assumption that macOS is inherently more secure than Windows. While macOS has stronger permission controls, social engineering bypasses them. The malware asks politely for access, and the user grants it. Code signing and notarization from Apple would have stopped the unsigned macOS variant, but many legitimate tools are distributed outside the App Store. The industry must push for stricter signing requirements for development tools used in Web3.
Takeaway: The Quiet Architecture of Trust Stability is the quiet architecture of trust. The Relay attack is not the last of its kind; it is the first of a new breed. The next wave of social engineering will not be fake airdrops or phishing emails. It will be fake job offers, fake audit reports, fake community managers—all leveraging the narratives that currently dominate attention.
We need to build a two-layer defense: the technical layer (hardware wallets, sandboxed execution environments for interviews) and the social layer (verifiable credentials for recruiters, mutual attestation before file sharing). The industry must invest in decentralized identity infrastructure not just for DeFi, but for the human interactions that support it.
Value flows where attention decides to rest. Right now, attention is resting on AI hiring tools. The attackers know this. It is time for the industry to secure the human layer with the same rigor we apply to protocol security. Security is a silent promise kept between nodes—and every node in this network is a person with a private key.
Why This Matters for Your Portfolio While Relay does not directly affect token prices, it signals a shift in the threat landscape that will have secondary effects. I expect increased demand for hardware wallets (Ledger, Trezor) and secure enclave solutions over the next quarter. Security tokens and identity protocols (such as ENS or zero-knowledge proof-based ID systems) may see renewed attention. Conversely, any project that relies on Telegram-based community trust or unverified recruitment channels faces reputational risk if an attack is traced back to them.
During the 2021 NFT cultural resonance report, I saw how sentiment drives liquidity. The sentiment around security is currently a tailwind for defensive plays. But be cautious—bull markets have a short memory for fear. The Relay panic will fade, but the infrastructure changes it necessitates will compound over time.
A Personal Note As someone who has spent years auditing code and managing risk, I have seen many attacks. Relay is different because it preys on the very human desire for opportunity. The attackers weaponized hope. The best defense is not a better firewall, but a deeper awareness that in Web3, trust must be earned in code, not in conversation.
I will be updating the fund’s internal incident response playbook to include mandatory sandboxed video call environments for all remote hires. I recommend every reader do the same. Trace the static in your system logs today, before the silence is broken by a transaction you did not authorize.