Can a Job Interview Drain Your Crypto Wallet?

A take-home coding test from a crypto recruiter can install malware that empties your wallet the moment you connect it.

Getting a technical assessment from a Web3 startup doesn't mean you're a strong candidate. It can mean a backdoor just landed on your laptop, waiting for a wallet to open.

What Is the Contagious Interview Scam?

Researchers at Group-IB and Microsoft track a campaign they call Contagious Interview, attributed to North Korea's Lazarus Group. The playbook is simple. Someone contacts a developer on LinkedIn, Telegram, or X claiming to represent a crypto trading firm or an "AI solutions" startup, praises their GitHub profile, and invites them to a final technical round.

The round is a take-home coding test hosted on GitHub, GitLab, or Bitbucket. Clone it, run npm install, then start the project like any other assignment. Microsoft published details on March 11, 2026, tracing the loader to a malware family security researchers call BeaverTail, which in turn drops backdoors including OtterCookie and FlexibleFerret. Unit 42 first documented the fake-recruiter playbook back in 2023. It hasn't gone away. It's gotten more convincing.

How the Fake Interview Steals Your Wallet

The "assignment" runs a script the moment you install it, usually through a postinstall hook npm executes automatically. That script scans the machine for MetaMask and Phantom local storage, Exodus and Electrum data folders, browser-saved passwords, SSH keys, and any .env file sitting in a project directory. It packages what it finds and sends it to a server the attacker controls over a plain HTTP POST.

Once they have a seed phrase or a private key, there's no approval to revoke and no transaction for you to sign. They just move the funds. That's what makes this scarier than a phishing site: a phishing site needs you to click "connect" and "sign." A stolen key needs nothing from you at all, ever again.

Why Crypto Developers Are the Target

Developers are worth more to steal from than the average wallet holder. Many hold personal funds and a project's deploy key on the same laptop, so one infected machine can drain a multisig signer as easily as a personal address. And the fake-interview vector is only one branch of a wider push. CoinDesk reported on March 19, 2026 that a phishing wave dubbed OpenClaw targeted the same population - open-source crypto contributors - with a fake $5,000 token airdrop that led to a wallet-draining site instead of a payout.

ReversingLabs has tracked the same tradecraft moving upstream into the supply chain itself: attackers phished maintainers of popular npm packages, including debug and chalk, and slipped drainer code into the update. A separate campaign named TrapDoor used 36 malicious packages across npm, PyPI, and Crates.io to grab wallets and credentials in one sweep. A wallet drainer doesn't need a fake interview to reach you. The interview is just the highest-converting bait right now.

Could a Real Company Ask for a Coding Test Like This?

Legitimate technical interviews rarely need you to run a stranger's code, on your everyday machine, with your real wallet unlocked, before you've even had a call with a human. A few patterns show up in nearly every reported case:

• The recruiter's profile is new, has no mutual connections, or the "company" has no verifiable careers page.
• There's pressure to run the test tonight, or before a made-up deadline, with no room to review the code first.
• Instructions tell you to disable antivirus or a firewall "so the test runs properly."
• The repository has almost no commit history or stars outside whatever was pushed for your interview.

Any one of those is a reason to stop. Two together, and you should assume it's Contagious Interview or a close copy.

How to Protect Your Wallet Before You Even Apply

Run any take-home test inside a disposable virtual machine or container, never on the machine that holds your main wallet. Keep a burner wallet with nothing in it for any "verification transaction" a recruiter asks for - a real employer pays in fiat or a stablecoin transfer you initiate, not through a connect-and-sign flow they control. If a "test" or "payout" ever asks you to connect a wallet before you've even met anyone from the company, treat that request as the attack, not a step in the process.

If you already ran the code, don't wait to find out. Move whatever was in any wallet that was unlocked on that machine to a new wallet on a clean device, then revoke every token approval tied to the old address. Some developers then try to trace where the stolen funds went by hand, address by address, on Etherscan. Plastron runs the same check in seconds across seven EVM chains, screening the destination against sanctions lists, stolen-funds clusters, and a labeled scam corpus in one pass - screen the wallet with Plastron.

That corpus is built for cases like this one: 3,901 addresses already labeled scam, fraud, or hack-linked, plus the full 780-address OFAC sanctions list. A Lazarus-linked payout address is exactly the kind of destination that data exists to catch.

FAQ

Is Contagious Interview only a Lazarus Group operation?

Group-IB and Microsoft attribute the core campaign to Lazarus, but the method - fake recruiter, take-home test, malicious package - has been copied in unrelated npm supply-chain attacks like TrapDoor, without confirmed North Korean attribution.

What if I already ran the coding test?

Assume the machine is compromised. Move funds out of any wallet unlocked on it, revoke that wallet's token approvals, and don't use the machine for anything financial until it's wiped and reinstalled.

Can antivirus catch this malware?

Sometimes, but the BeaverTail-family loaders are obfuscated JavaScript that regularly slips past signature-based scanners. Isolation, a VM with no wallet access, stops the theft before detection matters.

Does this only target job seekers?

No. The same connect-and-run trick shows up in fake bounty and airdrop offers, like OpenClaw's fake $5,000 token giveaway in March 2026. Treat any unsolicited crypto opportunity that asks you to run code or connect a wallet the same way you'd treat a fake interview.