Social Engineering Attacks: 3 Types of Scams Impersonating Support, KOLs, and Officials

You receive a Twitter DM: “I’m Gate.io support, your account has异常 needs verification”—you provide info then assets stolen. This isn’t you being careless—it’s social engineering—scammers exploiting your trust in authority to extract information.

3 Types of Social Engineering Scams

1. Impersonating Support

Scammers impersonate exchange/wallet support DMing you saying account异常/won prize/needs verification.

Defense: Official support will never主动 DM you. For any issues, go to official website support channels.

2. Impersonating KOLs

Scammers create accounts similar to知名 KOL names posting fake operation advice or fake links.

Defense: Check if account has verification badge. Never get operation advice from DMs.

3. Impersonating Officials

Scammers impersonate project方/exchange officials publishing fake announcements, fake airdrop links, fake support.

Defense: Only get information from official Twitter/Discord/website. Never operate from links in DMs or group chats.

Social Engineering Attack Psychology

Scammers exploit 3 psychological traits:

• Authority trust: You trust “support” “official”
• Urgency: You act without仔细 judgment来不及
• Greed: You see “free benefits” and冲动 act

Core Defense Principles

1. Officials will never主动 DM you
2. Any urgent request to act via DM is a scam
3. Only get info from official channels
4. Never operate from DM/group chat links
5. Any疑问 first confirm on official website

More Complex Social Engineering Variants

1. Impersonating project方 for governance attacks: Scammers impersonate project方 members proposing “emergency governance changes” →制造紧急感 → community rushes投票通过 → actually恶意提案 → project funds transferred

2. Impersonating legal institutions: Scammers send forged legal documents → “your crypto trading涉嫌违法 please cooperate with investigation” → you fear → provide personal info and wallet info → stolen

3. Impersonating exchange security teams: “Your Gate.io account has security risk please verify immediately” → provides fake link → you input account password → account stolen

4. Impersonating acquaintances/friends: Scammers steal social media accounts impersonating your friend → “I urgently need money help me transfer some crypto” → you好心 help → scammed

5. Impersonating recruiters: “XX blockchain company hiring remote position” → needs you “test contract” → actually makes you deploy malicious contract or authorize phishing contract → your assets stolen

Defense Psychological Habits

1. Question authority: Any声称来自 “official” “support” “legal” info must先验证
2. Reject urgency: Any制造紧急感 info cool down 24 hours first → 99% of urgency is人为制造 → real officials won’t make you恐慌
3. Be警惕 of free: Any “free获得” high-value东西 must质疑 → free lunch背后必有代价
4. Confirm identity: Any声称 “support” “KOL” “friend” must verify through other channels
5. Trust intuition: If something feels “slightly off” → trust intuition → don’t ignore疑虑 because “looks professional”

After Social Engineering Attack Emergency Response

1. Assess loss scope: Only leaked personal info? → medium risk. Leaked passwords? → immediately change all. Inputed mnemonic? → extremely high risk → immediately transfer all assets to new address. Authorized malicious contract? → immediately revoke and transfer remaining assets
2. Emergency止损: Revoke所有可疑 authorizations (Revoke.cash), change所有相关 passwords, transfer remaining assets to new address
3. Report and追踪: Report at exchange, report in Discord/community to help others避免, preserve all evidence
4. Reflect and改进: Analyze被骗原因,改进 security habits, update security measures

Summary

Social engineering attack核心: exploiting your trust in authority and urgency to extract info. Defense核心: officials don’t DM, urgent requests = scam, only get info from official channels.

For more practical methods, see Demonjoy Trading.