Cyberattacks targeting employees in the Swiss fintech and Web3 sectors have increased since the beginning of the year, according to the Federal Office for Cybersecurity (Bacs), NZZ reported.
Hackers Use Fake Job Offers to Compromise Systems
Attackers are increasingly using LinkedIn to target professionals within the cryptocurrency industry. The process typically begins with a headhunter contacting a victim with a lucrative, tailored job offer. Following a video call, the perpetrator claims technical difficulties occur and sends a program intended to resolve the issues. This software contains malware that grants attackers access to the victim’s computer, allowing them to steal credentials, access corporate networks, or seize private keys and tokens from crypto wallets.
This specific method is a hallmark of North Korean hacking groups. The group known as TraderTraitor, which is part of the North Korean intelligence service RGB (also referred to as the Lazarus Group), recently used fake job offers to target software developers. This group was linked to a massive theft of $6.4 billion from the Binance platform.
Swiss Fintech Firms Face Growing Financial Risks
The Federal Office for Cybersecurity (Bacs) has recorded 18 such cyberattacks against fintech and Web3 employees so far this year. While the exact total of stolen funds remains unknown, Bacs notes that public sources suggest damages of at least 130 million Swiss francs since 2021. Authorities believe the actual figure is significantly higher because employees often lack the incentive to report attacks stemming from job applications, giving hackers time to move undetected through corporate IT systems.
One of the largest documented attacks on a Swiss crypto firm involved a loss of over $60 million, though Bacs has not identified the specific company. In June 2024, the startup Lykke lost more than $22 million to attackers before eventually declaring bankruptcy.
The Swiss Financial Market Supervisory Authority (FINMA) has also identified an increasing threat from these professionalized cyberattacks. Both FINMA and Bacs have issued warnings and recommendations to Swiss blockchain and fintech companies regarding these evolving risks.
Criminals Use Mixers and High-Frequency Trades to Hide Funds
Once funds are stolen, hackers employ sophisticated techniques to move assets through the financial system. To obscure the origin of the stolen cryptocurrency, attackers often use thousands of automated high-frequency transactions to move assets between different wallets and blockchains. This complexity is intended to overwhelm forensic analysis tools.
Cybercriminals also rely on “mixers,” which are decentralized finance (DeFi) applications that allow for asset trading without intermediaries like banks. These services pool funds from various sources and split them into smaller amounts across numerous internal wallets, delaying payouts to make the assets difficult to trace to a specific robbery. While the U.S. Treasury Department sanctioned the mixer Tornado Cash in 2022 for its alleged role in laundering North Korean hacker funds, a court decision in 2025 lifted those sanctions. However, services like Blender and Sindbad remain on U.S. sanction lists.
The scale of these laundering operations is significant. According to the analysis firm Chainalysis, Chinese-speaking actors’ involvement in these activities rose to approximately 20% last year, compared to almost zero five years ago. Chainalysis estimates that $82 billion in crypto assets will have been laundered by 2025.
Swiss Authorities Monitor High Money Laundering Risks
The Swiss Federal Council highlighted the heightened danger posed by crypto assets in its mid-October report on money laundering and terrorist financing. The report specifically notes the risk of moving funds between crypto exchanges and traditional banking channels to integrate illegal money into the formal financial system, labeling the risk for specialized crypto banks as “high.” The Federal Council’s report also emphasizes the increased risk of attacks from North Korean actors.
Stephan Zimmermann, head of legal at the crypto bank Sygnum, stated that the risk to the Swiss industry has risen massively, particularly due to the use of artificial intelligence. To mitigate these threats, Sygnum has implemented strict measures, such as refusing any transactions originating from mixer applications and requiring customers to provide clear proof of the origin of their assets.
Following the Binance breach, the FBI released a list with contaminated wallet addresses where crypto funds from Binance appeared or that are connected to TraderTraitor.
Spot Suspicious Recruiters Sending Files to Fix Technical Issues
How can I identify a fake job offer from a hacker?
Be highly suspicious of recruiters who insist on sending software or files to “fix” technical issues during a video call. Legitimate headhunters will not require you to install unverified programs to facilitate a job interview or technical demonstration.
What is a crypto mixer and why is it used by criminals?
A mixer is a DeFi application that pools digital assets from various users and redistributes them to different addresses. Criminals use them to break the direct link between a theft and the final destination of the funds, making forensic tracking much more difficult.
What are the specific risks for Swiss crypto companies?
Swiss firms face targeted social engineering through platforms like LinkedIn and the risk of large-scale asset theft. Authorities like Bacs and FINMA have noted that the professionalization of North Korean hacking groups and the use of AI have increased the frequency and sophistication of these attacks.