Crypto Scams: How Fake Job Posts and the GrassCall App Drain Your Wallet
With the rise of Web3 and remote work, scammers have begun to heavily exploit fake crypto-related job postings to steal funds. One of the latest examples is the GrassCall app, disguised as an online interview platform. In this article, we’ll break down how this scheme works, how to protect yourself, and what to do if you’ve been targeted.
1. How the Fake Job Scheme Works
Scammers post advertisements on popular platforms (LinkedIn, HeadHunter) offering:
- High salaries ($5–10K/month) for “easy work” in crypto projects.
- “Training” in trading or blockchain analytics.
- Bonuses for completing an interview.
After you apply, they send you a link to an app like GrassCall, which:
- Requests access to your MetaMask or Trust Wallet.
- Asks you to “sign a transaction for verification.”
- Steals all funds via a signed contract.
According to SlowMist, $220 million has been stolen through such schemes in 2024 alone.
2. Example Attack: How GrassCall Deceives Users
| Stage |
Scammers’ Action |
Goal |
| 1. Attraction |
Fake “work” testimonials on Twitter |
Build trust |
| 2. Interview |
Video call with a “HR manager” |
Give an appearance of legitimacy |
| 3. Infiltration |
Installing GrassCall (a trojan) |
Steal seed phrases |
3. Top 5 Signs of a Fake Job Posting
- They require access to your wallet. Real employers never ask for private keys.
- They promise quick income. “$10k salary with no experience” is a huge red flag.
- Links to unknown apps. Legit projects typically use Zoom or Google Meet.
- Errors in the job description. Unprofessional language, spelling mistakes.
- Pressure for urgency. “Send a transaction now or the position will be filled.”
4. How to Protect Yourself: Expert Tips
4.1. Verify the Job Posting
- Look for reviews about the company on Glassdoor and CoinGecko.
- Check the website domain against the official one (e.g., binance.com vs binanсe.cc).
4.2. Secure Your Wallet
- Use a hardware wallet (Ledger, Trezor).
- Never sign transactions in suspicious apps.
4.3. Steps if You’ve Been Hacked
- Immediately move any remaining funds to a new address.
- Revoke access through Revoke.cash.
- File a complaint with the platform where the job was posted.
5. Real Cases: Stories from Victims
- Case 1. A user in India lost $34k after installing GrassCall for a “test assignment.”
- Case 2. A fake “Binance HR team” posting led to the theft of 12 BTC.
Attorney Maria Sokolova advises: “Keep all your chat logs—this will help if you pursue legal action.”
6. How Platforms Are Combating Scammers
- LinkedIn. Has implemented AI filters to block suspicious job ads.
- MetaMask. Added warnings about fake dApps.
- CertiK. Launched the Skynet Alerts service for verifying job postings.
Conclusion
Scammers are constantly evolving their tactics, but knowing how they operate significantly lowers your risk. Always verify the people you’re dealing with, use separate wallets for work, and practice proper digital hygiene. Remember, in the crypto world, your security is ultimately in your own hands.
