# @XBToshi: Crypto's multisigs and MPC setups fail when attackers target engineers

Source: https://x.com/XBToshi/status/2115999604508672013
Kiwi News: https://news.kiwistand.com/stories/XBToshi-Cryptos-multisigs-and-MPC-setups-fail-when-attackers-target-engineers?index=0x6ae43d4a70568d55f75e11405ed8461c9d93f4aafb0bca949d97c4d9eaea01a4e0043307
Submitted by tim on 2026-10-30 UTC, 2 upvotes, 1 comment

## Summary

This post argues that crypto's multisig, KMS and MPC security setups are often defeated not through cryptographic weaknesses but by attackers targeting individual engineers. The author says attackers can find a DevOps engineer on LinkedIn, send a poisoned PDF, and gain full sudo rights, and that the human endpoint is a bigger weakness than smart contract code. The post attributes these attacks to Lazarus and describes them as state-sponsored cyber warfare against engineers working from home.

## Article

It's state-sponsored military cyber warfare against normal engineers working from home.

Crypto spent billions building multisigs, KMS enclaves, and MPC clusters, but the adversary isn't trying to crack prime numbers. They find one tired DevOps dev on LinkedIn, send a poisoned PDF, and walk straight through the front door with full sudo rights.

You can audit your smart contracts fifty times, but the human endpoint is always running zero-day vulnerabilities.

Damn, Lazarus is good at breaking people.

## Comments

**misha**: Btw poisoned PDF is a thing; recommend to use Dangerzone to first open PDFs 🥷 ⚠️ https://dangerzone.rocks/