# Singapore crypto scam loses US$11.8 million via fake job offers

**Published:** 2026-08-16T17:44:35.016Z  
**Topic:** Crypto Scam  
**Sentiment:** neutral  
**Publisher:** TrendWatcher — https://www.trendwatcher.in/article/7f9972a8-c57d-4db6-b0e5-0cdb5ec05975

Singapore police and CSA warn of a crypto scam that stole US$11.8 million through fake recruiter offers and malware‑infected coding tests.

US$11.8 million (S$15.1 million) was siphoned from a Singapore‑based firm after a scammer posed as a recruiter, stole API keys via a malicious coding test, and bypassed transaction limits to move crypto assets, authorities said on Aug 14 2024【1】.  

| At a glance | |
|---|---|
| Loss | US$11.8 million (S$15.1 million) |
| Date of advisory | 14 Aug 2024 |
| Scam method | Fake LinkedIn recruiter → spoofed email domain → video interview with video off → malicious coding assessment |
| Access vector | Compromised Bitbucket account & internal servers |

## How the fraud unfolded  
The victim was first contacted on LinkedIn by an individual claiming to recruit for a cryptocurrency‑related firm. After a series of email exchanges using a domain that closely mimicked a legitimate company’s address, the victim joined several Google Meet interviews where the interviewer's video remained disabled. The scammer then directed the victim to a counterfeit website to complete a technical coding assessment on a company‑issued laptop. The download installed malware that harvested the victim’s session token, allowing the attacker to bypass multi‑factor authentication and seize control of the victim’s Bitbucket repository. Because the repository was linked to the company’s internal codebase, the attacker could modify server configurations, retrieve internal credentials, and override transaction limits to execute cryptocurrency transfers without detection【2】.

## Authority response and mitigation advice  
Singapore’s Police Force and the Cyber Security Agency issued a joint advisory urging developers and technical staff to verify recruiter identities through official channels, to insist on video‑enabled interviews, and to avoid executing code from unverified sources. They also recommended businesses protect API keys with temporary credentials, enforce strict transaction limits, and strengthen multi‑factor authentication with device‑binding controls. Organizations are advised to monitor for unfamiliar devices, unexpected account access, and to isolate compromised systems immediately, revoking active sessions and resetting credentials where a breach is suspected【1】.

## What to watch  
- Any large‑scale crypto transfers originating from corporate Bitbucket accounts or similar code repositories.  
- Emerging phishing campaigns that mimic recruiter outreach on professional networks such as LinkedIn.  
- Updates from Singapore’s CSA and SPF on additional advisories or enforcement actions related to supply‑chain‑focused crypto scams.  

The incident underscores how attackers can leverage compromised development tools to infiltrate corporate crypto wallets, bypassing traditional security layers. As more firms integrate blockchain operations into their software stacks, vigilance over code‑repository access and recruiter verification will be critical to prevent similar multi‑million‑dollar losses.

## Sources
1. The Straits Times — [$15 million lost in cryptocurrency scam involving fake job offers, compromised software systems](https://www.straitstimes.com/singapore/15-million-lost-in-cryptocurrency-scam-involving-fake-job-offers-compromised-software-systems)
2. AsiaOne — [Over $15m lost to crypto scam involving fake job offers, compromised software systems: CSA, police](https://www.asiaone.com/singapore/15m-lost-crypto-scam-fake-job-software-csa-spf)
3. Channelnewsasia — [Authorities warn against cryptocurrency-related scams involving fake...](https://www.channelnewsasia.com/singapore/cryptocurrency-scam-us118-million-losses-6319186)
4. CoinDesk — [Latest Crypto News | CoinDesk](https://www.coindesk.com/latest-crypto-news)

---
Cite as: TrendWatcher, "Singapore crypto scam loses US$11.8 million via fake job offers", https://www.trendwatcher.in/article/7f9972a8-c57d-4db6-b0e5-0cdb5ec05975