Web3 Projects Targeted by Insider Cyber Attacks
In a recent wave of cyber attacks, hackers posing as IT professionals infiltrated multiple NFT and Web3 platforms, stealing over $1 million in cryptocurrency, according to onchain investigator and security analyst ZackXBT.
The attacks, which occurred over the past week, targeted several Web3-based firms including Favrr, a fan-token marketplace, as well as NFT projects Replicandy and ChainSaw. These are among several unnamed victims affected by malicious insiders exploiting remote work vulnerabilities.
NFT Minting Exploited: Price Floors Collapse
The attackers manipulated the minting mechanisms of these NFT platforms, creating unauthorized large quantities of NFTs, quickly dumping them on the market. This aggressive selling strategy crashed the price floor to zero, allowing the hackers to extract profits at the expense of genuine users.
“The threat actors executed a coordinated sell-off, collapsing floor prices while siphoning value across multiple wallets,” explained ZackXBT in a recent post.
The stolen funds from Favrr were funneled through nested services (a method to obfuscate blockchain activity), while the proceeds from the ChainSaw exploit remain mostly dormant, suggesting a potential delay in laundering or cashing out.
Remote Work Opens the Door to Social Engineering
This trend highlights a growing threat in the crypto space: insider attacks using social engineering. Hackers have increasingly posed as IT developers or staff, exploiting remote work hiring processes to gain access to sensitive infrastructure.
In a broader context, cybercrime within Web3 and tech firms has surged. In November 2024, a group linked to North Korea’s “Ruby Sleet” was found infiltrating defense and tech contractors, using fake job listings and social tactics to compromise internal networks.
Coinbase Breach Underscores Insider Risk
Even major firms are not immune. In May 2025, crypto exchange Coinbase confirmed that external attackers bribed customer support contractors, accessing sensitive client data. Over 69,000 users were affected, with leaked data including names, addresses, and phone numbers.
Conclusion: Web3 Needs Stronger Internal Security
These events underscore the urgent need for robust internal cybersecurity policies across blockchain and crypto companies. As threat actors continue evolving, project teams must implement rigorous hiring checks, monitor developer access, and remain alert to social engineering tactics.
“Your greatest threat may not be an external hacker — but someone on the inside.”
Disclaimer
This content is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency trading involves risk and may result in financial loss.