A Scam Made to Measure

The client I remember most was a smart contract developer.

He writes the code that moves value on-chain. He understands approvals and signatures at a depth most users never reach. He was lured by a fake airdrop, a distribution of governance tokens to active users in an ecosystem, and signed a single drainer transaction: a malicious request that, once authorized, empties the wallet.

It was over. Everything gone.

If it can happen to him, it can happen to anyone. That sentence gets repeated so often it has gone soft. It deserves to be taken literally.

Over the years I have started to read scams the way a tailor reads garments. Fraud comes in sizes, and each size is cut for a different level of knowledge.

At the entry level hangs the off-the-rack work: pig butchering, fake investment platforms. Cut loose, so it fits almost anyone. Slow, patient manipulation that builds trust for months before draining the account. The craft is in the patience, and the measurements are generic: loneliness, hope, the wish for a quiet return on savings.

At the high end sits the bespoke work: drainers and malicious approvals. These target people who know the fabric. The victim has to understand what a token approval is, what a signature authorizes, how a legitimate claim page behaves, and be fooled anyway. The trap only works on a trained eye, and a trained eye is exactly who it was made for.

This is what makes drainers so insidious. They are built for one specific day: the ordinary one. You are moving fast. You are half distracted. The site looks exactly like the one you have used a hundred times. One signature is enough. It says nothing about you and everything about how well the trap was designed.

Running through every tier, from the crudest to the finest, is the same craft: social engineering.

The tailor’s skill was never the sewing. It is the measuring. And that work does not happen only online. It happens in person, in a conversation, a handshake, a moment of misplaced trust. The strength of the cryptography is irrelevant when the target is the person who holds the keys. The technique adapts to the wearer.

I worked a case where a founder met his “investors” the way anyone would: over dinners, introductions, a partnership that took shape over weeks. There were business cards, a real office, a term sheet that read like the dozens he had seen before. The trust was built across a table, in handshakes and shared bottles of wine, long before a single transaction was signed. By the time they asked him to move funds to a “jointly controlled” wallet “to close the round,” the outcome was already decided. No malware, no spoofed domain.

The whole attack was social, and the keys never stood a chance.

The developer from the opening taught me something I have had to relearn several times since. He knew what a signature could authorize. He had written that logic himself, and the trap held anyway. Knowledge raises the price of fooling you. It rarely makes that price unpayable. A token approval set too high. A transaction signed on autopilot. One click while your attention is somewhere else, and the attack surface you spent years minimizing opens up completely.

Security that depends on a human being permanently alert is a system that only works on your best day.

This is also why empathy belongs in this work. When we hear how someone lost their funds, judgment comes cheap. But behind the transaction hash there is almost always a household.

I have sat across from families who lost the work of a lifetime: entire pensions, the savings of thirty years of early mornings and postponed wishes, the money that was supposed to become a home, a retirement, a margin of safety for the children. A retired couple moving that pension into what looked like a regulated platform was not being greedy; they were applying the rules of a world they knew, where institutional appearance equaled safety.

Every mistake has to be read against the knowledge and the circumstances of the person who made it. On-chain it reads as a single transfer, a row in a spreadsheet. In a living room it’s a silence at the dinner table that no recovery effort can turn down.

The same reading applies to everyone, the retired couple and the smart contract developer alike. What looks obvious from the outside rarely felt obvious in the moment, under pressure, mid-distraction, at the end of a long day. And the people it fits most cruelly are often the ones who brought everything they had, because the trap was built for exactly that: a lifetime of trust, concentrated in one account.

Many businesses still underestimate custody and secure operational workflows, and the tailoring model explains why. They train people to recognize the trap, then leave the fitting room open. Security is a design problem before it is a training problem.

The developer needed a workflow where an unknown contract could never reach a signature at all: the roster of trusted contracts settled ahead of time, in a calm moment instead of a distracted one. The decision made once, deliberately, so the malicious request that emptied his wallet would simply never have arrived.

The founder needed something else entirely. No contract could have saved him; the trap was built across a dinner table, not hidden in a domain name. But signing infrastructure that shows the authorizer exactly what a transaction will do every single time, forcing deliberate inspection and leaving no room for ambiguity, transforms “move the funds to close the round” from a socially conditioned next step into a concrete, inspectable action. It turns a moment of distraction into a controlled decision.

Each of these measures does the same thing: it moves the critical decision away from your worst moment and into your calmest one. Every contract whitelisted in advance, every signature the signer actually understands. A workflow that never lets an unknown contract reach a signature gives him nothing to fit.

The goal is not to create humans who never make mistakes. The goal is to design systems where ordinary human moments cannot become irreversible losses.

Next: Episode #4: Second-Hand World (Part 1): What LLMs Inherit From the World They Never Touched