# The Long Con: Pig Butchering, Drainers, and Job Scams by Luker | Devcon SEA

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2025-10-09
- Duration: 25:02
- Topics: Science & Technology
- Watch: https://streameth.org/watch/yt-XS2YF2WgIfU
- YouTube: https://www.youtube.com/watch?v=XS2YF2WgIfU

## Description

I'll discuss the different types of malicious actors from low-skilled script kiddies to government-sanctioned advanced persistent threats. This presentation will include an overview on drainer groups and how sophisticated scammers string along their victims, fattening them up before extracting as much value as they can, as well as the nefarious practices these operations employ. Finally, I'll focus on the recent rise of job scams that have been targeting builders and employers alike.

Speaker(s): Luker
Skill level: Beginner
Track: Security
Keywords: Security, Custody, threat, intelligence

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum, https://warpcast.com/devcon
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon SEA was held in Bangkok, Thailand on Nov 12 - Nov 15, 2024.
Devcon is organized and presented by the Ethereum Foundation. To find out more, please visit https://ethereum.foundation/

## Transcript

[Music] hello everybody Welcome to my talk thank you for coming we're going to cover as mentioned uh Pig butchering drainers and job scams or as I like to call it the most depressing talk at Devcon so buckle up it's going to be fun um but before we get into any of that we're going to have to start with social engineering of course because uh the vast majority of uh crypto scams begin and end with social engineering um I mean everyone can be a Target I don't care if you were homies with Satoshi or you just started dabbling because your grandkids thought that pudgy penguins are cute we are seeing people uh from all levels of experience getting hit by social engineering um some of you may have uh seen the headlines a few months ago when $ 243 Million worth of bitcoin was stolen from a single person and that was because of social engineering the scammers were actually able to pose as uh customer support from Google and Gemini and they talked this this target into giving up his Bitcoin Keys uh and these jabronies got a little cocky and uh thanks to some investigative work by Zack xbt shout out uh they were able to track them down um so there are some groups in the space um individual researchers projects companies who are all working together to try and make the space safer for users this is a few of them there are others and if I haven't mentioned you thank you for the work that you're doing um but we're all trying to put guardrails up for the ecosystem warn users when they're about to do something dangerous I'm sure a lot of you have seen this big red screen of death before that is triggered when you are about to interact with the URL that's on one of the block lists and just so you know it's getting a facelift so if you see something different than what you're expecting that is expected and uh it's not actually dark mode but we decided that this design was going to be a little snazzier so some tips about social engineering support is never going to contact you uh never trust links that are shared on social media come from unsolicited emails uh Discord telegram all that stuff you're going to want to avoid and if support does contact you about something that you think might be legitimate stop that conversation go to where you know the actual legitimate support link is and contact support that way because they will actually be able to tell you what's up for Builders make it really obvious for your users to know where the actual support link is found um it's really on the builders to make sure we protect the users it shouldn't be put the other way around and the owners to be on the user the owners to be on the users but uh let's get into drainers uh the they are designed to Max maximize the value out of theft the drainers as services are they're complete kits that can be used by just about anyone regardless of their expertise and I mean these are businesses they are complete with their own advertising their own customer support and as it turns out even mergers and Acquisitions uh getting back to the account or to the social engineering there's account takeovers are uh one of the tactics that is usually employed to get those risky clicks and these scammers are bold enough to uh compromise nft projects government organizations like the SEC even italic got hit at one point of course they're always going they're use the the classic fishing the brand impersonator impersonations fake airdrops and giveaways and another tactic that we are seeing is the Compromise of the JS Supply Chain by gaining unauthorized access to publish malic malicious versions of packages that are then used by defi front ends uh yes so uh these services are easy and quick to spin up again you don't need any kind of advanced expertise to use them fighting them is like playing whack-a-mole they are constantly iterating they can Target many users with a single campaign and uh as scam sniffer recently calculated just one of these drainer Services uh which this was an inferno has amassed over $250 million from uh 215,000 victims and so if you see with just these seven campaigns here there is a combined reported loss of 75 over $75 million and there's what we're seeing a lot is countless cases of individuals who are losing smaller amounts at a time so that really adds up but I do want you to rest assured that so far there have been no reports of theft by mudang that's we're safe there there um and then as some campaigns become more successful uh the drainer vendors are looking to acquire customers from other other vendors who are retiring you know the more Affiliates they get the more money that they can make because they're making a percentage off of each hit and by acquiring Inferno Angel drainer has now gained all of their Affiliates and all of their drainer strategies so don't get drained double check URLs don't trust unsolicited messages beware of giveaways uh read and understand the transactions that you're about to sign and you know just practice General good wallet hygiene these are the basics that we should all be practicing anyway moving on to job scams um one on one side of it it's the the scammers are posing as recruiters as mentioned in the previous talk um they could offer exciting job opportunities competitive pay really good benefits uh maybe this is a big step up from your current current position it's very enticing um but they're going to contact you through social media or some kind of me messaging app and then once they Garner your interest they will have you do a skills test and this is you know very common for developers in our industry but what the next step is is they're going to ask you to clone a repo or download some files and then that's how they get you and if you notice on this uh fake offer from coinbase uh the link to the GitHub is not to a coinbase repository um so really once they get you to do the cloning and the downloading then they can compromise your machine and do a whole lot of damage there so even if you're not looking for a job uh they might be appealing to your sense of community they might come to you and ask you to collaborate on a project or ask you to help and I think especially in this space it's kind of uh our nature to want to lift up the builders around us too but that's again that's going to be how they get you because you kind of need to always be aware of the stranger danger when it comes to these sorts of things and if you happen to be using uh your company's laptop to help them out then you've now compromised your company server infrastructure and that's not going to be good for anyone so um some tips of avoiding these job scams don't clone repost from strangers don't run or build code from strangers unless you're using uh protections like lava Moe and just do some digging into the source of the repo uh and again just practice really good everyday crypto maintenance hygiene and then uh on the other side of this the scammers are posing as job Seekers uh they are targeting crypto projects from startups to Big powerhouses in the space and uh Zach xbt again he recently disclosed that infiltrators infiltrators are using counterfeit identification to get hired by a startling number of crypto companies uh one high-profile hack from March was munchables who lost uh $63 Million worth of eth and it turns out that that was actually at the hands of one of their own developers who allegedly had ties to North Korea besides the financial loss at stake uh you know it's illegal to violate sanctions laws and most of these scammers are connected to the dprk so so far in the us the FBI has been gracious if companies come forward they are seen as victims themselves there might be a Tipping Point where that is no longer the case and it's no longer victimhood and that falls into negligence that's my speculation but I'm if you are a company who is hiring just always play safe and if you suspect that you have hired someone from a sanctioned country then it's going to be in your best interest to report it um and you know invest in really thorough a high level thorough background checks um the these some of these people are going to have verified previous employment some of them have GitHub accounts that go back for years and years and uh it's going to be really hard to spot some of them some of them are easy but some of them are not and uh you know some best practices again are the principal lease Authority don't give anyone any more access to anything than what they need to do their job keep uh the access to sensitive materials to the bare minimum number of people and look out for suspicious behavior of new hires uh what we have been seeing a lot of is like one identity of a worker will actually be passed between several people behind the keyboard so keep an eye out for big shifts in personality big shifts in speech pattern all that kind of thing yeah they they're usually not going to be on camera also um these are some of the top ADV persistent threat targets sorry advanced persistent threats their targets and their tactics that they use um of course Lazarus isn't on that list but they are definitely in the mix because they can't pass up a party um but some of these dprk workers don't even have to engage in sabot sabotage all they have to do is show up for their job you know do their do their work collect the paycheck and then funnel money back to the regime because really at the end of the day that's where all the money is going anyway and it's being used to fund the North Korean military and they have been able to make significant advancements over the past decade off of the hacks that they are accomplishing and um yeah the people Behind These scams the everyday workers aren't even going to get to keep the money it just all goes to the regime the uh un estimates between $250 and $600 million every year going to the dprk uh um it's very possible that over half of applicants in crypto are dprk and uh a just a little factoid a wage mole is someone who is uh seeking out both financial gain and Espionage and all of these things make mudang very angry but don't worry it gets worse uh Pig butchering this is the fun one uh this is where the scammer will build up a relationship over time to gain Trust um sometimes it's through social media sometimes it's through dating apps and again they they're they're building up the trust over weeks months years and they eventually will manipulate their targets into making investments in fake defi platforms uh and then they'll ask for more money and eventually just drain the account which is going in for the kill after fattening them up so this tactic was initially popularized in China uh before it spread to other parts of Asia and now we're seeing it actually in all sorts of places all over the world um and it'll start off usually pretty innocuous uh either you know it's a connection on a dating app or it's some colleague that you kind of sort of remember but don't from back in the day reaching out to you uh and it'll never start with them talking about crypto again they're building they're laying that Foundation of trust and then after a long time that they will uh they'll clue you in on some invest opportunity that they have for you um and of course if a stranger contacts you out of the blue it's really and then and they're like oh invests in a thing it's really easy to have those red flags you're not going to you're not going to engage with them but uh as more and more of our social relationships are happening online it's it's a little bit it's getting a little bit trickier because I'm I'm willing to bet that a lot of people in this room have uh friends and colleagues that they've never actually met in real life and I'm sure most of those people are not not Pig butcher but you know some of them very well could be uh and it's once that trust is formed once that you've uh engaged uh invested time and emotional uh connections with these people you've shared jokes and built up a rapport it's it's really hard to admit that they've been playing you this whole time and then if you factor in the romance aspect which most of these scams are based based off of then it gets really murky uh cuz these targets they're they're sometimes lonely they're looking for companionship and that's really what this comes down to and then once you are engaged in a an online relationship with someone who is who's uh uh expressing affection for you and then they're putting in hey there's like this financial gain you can have on top of it it all comes becomes very enticing uh and you know sometimes these people are uh have insecurities about their financial future or the financial future of their family so it's not always just based in greed of getting the gains uh I just wanted to point that out so some of the major steps that we see in most of these scams is first uh the scammer will present thems as very successful wealthy put together individual looking for a long-term relationship um they will send a lot of pics but not uh doing video although with the rise of AI and deep fakes we might a shift in that part of it but the the next part is grooming they will move very quickly to declare their love to the Target uh they will chat daily again being very affectionate and then eventually they will introduce the target to some third-party uh dii app or website that is fake and they will Coach them into how to buy crypto from an exchange and make the transactions because most of these targets are not crypto Savvy to begin with and that's when they start to put in the apply the pressure tactics they uh will want to get more money more quickly sometimes that there's a limited time deal that they need to act on right now and as the victim starts seeing their gains and wants to withdraw their money then all of a sudden it's stuck and they have to put in more money to get it out maybe there's some unexpected fee or a tax that you need to pay it's anything they can do to keep drawing more and more wealth out of these people uh and that will keep going until either the money is gone or the victim catches wise and at that point the scammer will ghost them and that's the end of that um and this is just an example of one of the fake platforms I don't know if I'm standing in the way uh you can see that it's very realistic uh and that's where you are watching your fake gains which uh are pretty colors to look at but your money's gone once you put it in there uh so a couple things to keep in mind about Pig butchering the scammer is not acting alone the majority of these scams are run by crime syndicates and the scammers have been specifically trained in order to gain trust and get the most value out of their victims they have quotas that they have to meet um and a lot of these uh activities are taking place in special economic zones that have little to no uh law enforcement going on so the gangs are able to run wild there uh and it's going to get a little bit darker now uh it's easy to see everyone involved in these scams as just evil but the truth is that a lot of them are actually participating against their will often they themselves have been scammed into uh being abducted by these groups so just put yourself in their shoes for a moment you know they they don't have a lot of money but they have a promise of a really good job the company has a fake online presence so you look into it it looks legitimate you show up to get the job they pick you up in a really nice car then they take you to another car that has a different driver and then maybe another vehicle and then you're on a boat and then you're just gone and what really happened that you you have been trafficked across International borders uh and they you're worth a lot of money to the people who have just bought you and the only way they're going to let you go is if your family comes up with a at least as much as they paid for you if not more and it's such an exorbitant amount that there's no way your family will ever be able to come up with that money um and of course because of that now you're being forced into labor of conducting these scams against other people in scam centers this is what one of the compounds looks like that they are taken to this one's in Cambodia um they have hundreds of rooms for tens of thousands of international victims and this is where they are taught um all the tactics to use against people one of the largest if not the largest uh compound for romance scams is KK Park uh they have made well over $100 million just in 2024 and uh this is how close we are to them right now um I don't I don't recommend taking any post Devcon trips up that way however this is how close we are to mudang and that might be a lot more fun of an adventure for you um I'm running out of time so this shows money movement that goes actually to some mainstream exchanges that have not been named and um okay trigger warning I'll go through this part fast they if the people don't meet their quotas they are tortured beaten deprived of sleep and food the guards use tasers and the list gets a lot worse from there so um if you want to get into that more find me after this talk because it might be a little heavy for some people um of course some people do get out they are coming forward with their stories they are sharing um but these Escape attempts are really dangerous so you know they can get injured or killed in the process the good news is that there are groups trying to help um this this one Global Advanced projects is a nonprofit they're dedicated to uh extraditing people from places like Myanmar uh where these things are happening and they actually bring them back here to Thailand because uh the the company is based in or the organization is based in Australia but they have a lot of people on the ground here they bring them back to Thailand to get them safe I don't have any affiliations with them but if you're trying to throw money at something this might be a really good one and if you want to dig deeper into what's going on with pig butchering they have a really great documentary it's short it's heavy but I would check it out uh and we did it we got through the most depressing talk at Devcon Pat yourselves on the back let's give a big round of applause I thought that was a very very informative session thank you so much I know you had to rush through a little bit but we really really appreciate now it really is important I've seen victims of these scams in person I know someone who was actually trafficked across the border and thrown into the back of a van passport taken whipped it right into the U the the like a concentration cam it's not even a room it's a concentration cam put in front of computer for 12 hours a day he has to scam people thankfully his family got him out but it is wild it is wild anyway let's look at some of the questions on the screen um who are at most risk of these scams oo which ones uh um I would say for uh I mean everyone really everyone is susceptible to social engineering and that's really the heart of all of this yeah I would say yeah um would you say that there's any people who are more at risk perhaps like older folks do you find that older people usually get more big butchering scams or yeah I would say old older people do uh but again it's it's people who want romance it's it's everybody there's different scams for everybody you know I think that's one way of putting it everybody can be scammed so never take it for granted all right uh okay oop excuse me have you ever visited a pig butchering scam Factory Heaven know Heavens no okay thank God thank God thank God for that all right next question is it common to decline a skills test or decline downloading a file in the process of an interview do you think employers should uphold the end of protecting everyone in the process now that's an interesting question that is a good question and I do think that it should be uh on the the companies to be educated themselves on what risks are out there and make sure that they put in safeguards themselves to protect people who are applying yeah I think that's a very true I mean this is something I've never considered before because like you've said you download one file and you know you could easily very easily be compromised okay have you seen examples of hackers or scammers using AI to make their scams more legit or for example using facial editing technology to impersonate others oh 100% And I didn't have it on one of my slides but yeah they they do they'll they'll take a you know an ID and then use to put their own face on it um they we I feel like we are going to see a lot more of the deep fake happening definitely as time goes on you know what my family and I have done is that we've come up with a secret word so we told our mother especially my mom because she tends to fall for scams um if someone calls you and says I've been kidnapped please send me money I have to say this secret word afro sorry um um you know um some other Secret SEC word perhaps not my hair but U because I think that's important because families really can can fall victim to these scams and I would highly recommend that you and your family come up with a safe word uh sorry secret word um oh my slight slip of the tongue there sorry live streamers um all right let's go the top everybody's voting voting voting okay keep the votes on consensus what is your opinion on Chrome security extensions that help secure mamas example cbus fire revoke cash wallet guard this wasn't really in your I mean it could have been in the beginning of your topic but do you want to comment on this so I would say with uh extensions just be very very careful with them keep them sort of to minimum I mean wallet guard as long as it's not a an imposter of Faking to be wallet guard just like do your homework and make sure that you're using the legitimate extensions and I would keep them to a minimum exactly and I would highly recommend Hardware wallets guys Hardware wallets okay in fishing attacks there are many attacks by North Korea Lazarus but are there any cases where you've heard of Russia or China sorry moved out Russia or China hackers what what's your experience with uh with Russia or China hackers or others absolutely uh so there's Lazarus but there is also uh Russia and China and actually Iran we're seeing a lot of Iran yeah all right I mean basically anywhere in the world right anywhere people want to make money they will find ways to hack you what in-person social engineering tactics are you aware of what should be wary of when traveling okay so this is in public let's say I'm in a setting like a conference what are some of the in-person social engineering tactics that people could employ oh okay okay so this is not my general area of expertise but um doing things to distract you um touching you um like any way that they can pickpocket you or get your phone anything like that uh I would watch out for yeah yeah the one that I've seen is when people say oh could you show me your telegram or something and they open their pin number and then you've got their pin number all you need to take is their phone and you can unlock everything so please be careful yeah um we've got 20 seconds let's do one last one are there any new attack vectors on the horizon we should look forward to rather look aware or be aware of uh oh well actually there was a report that came out last night from the Google Cloud cyber security uh forecast for 2025 and they are saying yeah again AI uh the evolution of AI tools by scammers however they're also saying that semi-autonomous AI could be used to combat them by security which is kind of exciting I AI versus AI yeah fantastic we've just come to the end of our Q&A let's give our speaker another big big round of applause thank you very very much