A trusted Zoom call turned into a devastating heist when Mehdi Farooq, a partner at crypto venture capital firm Hypersphere, lost years of digital wealth in a highly coordinated phishing attack. The breach, which drained six of his wallets, highlights a growing wave of AI-enhanced cybercrime targeting even the most experienced crypto professionals.

A Phishing Attack Disguised as Routine VC Business

The attack began innocently enough. Farooq was contacted via Telegram by someone impersonating Alex Lin, a known industry contact. The message seemed casual—a request to reconnect. Farooq responded by sharing his Calendly link, unknowingly taking the bait.

The attacker scheduled a video call, which was then redirected to a “Zoom Business” link under the guise of compliance requirements. They even name-dropped another real LP (limited partner) to enhance credibility. When the Zoom call began, there was no audio or video from the other party—just a prompt to update Zoom for the session to proceed.

The so-called update turned out to be malware.

Once installed, it silently compromised Farooq’s laptop and granted the attackers access to six cryptocurrency wallets. Within minutes, funds were drained. According to Farooq, the loss amounted to his entire crypto savings, built over years of work and investing.

Evidence of a Larger Pattern

Security experts suspect this was no isolated incident. The attackers appear to be part of a well-organized campaign using AI, malware-laced software updates, and social engineering. Researchers pointed to an alias “dangrouspassword,” linked to previous North Korea–affiliated activity and similar breaches across the DeFi and VC landscape.

This phishing vector—fake Zoom or Google Meet updates—is becoming a recurring tactic. Just weeks earlier, reports emerged of victims receiving hardware wallets in the mail as part of elaborate scams. And in April 2025, attackers netted $330 million in Bitcoin through fake support and malware traps.

Why It Worked

This scam succeeded because it exploited multiple layers of trust:

• The communication channel (Telegram) was familiar

• Calendly and Zoom are standard business tools

• The names used were recognizable within Farooq’s network

• No obvious red flags appeared—until it was too late

Even Farooq, an experienced investor who helps manage early-stage crypto and blockchain startups, admitted to feeling “completely blindsided.”

A Wake-Up Call for Crypto Professionals

As scams evolve, so must security practices. Experts now recommend the following:

• Always verify meeting requests and updates out-of-band — via phone or secondary channels

• Never install software during a live call, especially from links in chats

• Keep wallets air-gapped, ideally on separate devices with hardware protection

• Adopt strong endpoint protection and regularly scan systems

• Raise team awareness through training on phishing and AI threats

Industry Response

The incident has sparked concern within the crypto VC and DeFi sectors. Hypersphere has reportedly launched an internal review and is working with blockchain forensics firms to trace the stolen assets—though recovery is unlikely due to the rapid laundering methods often used by such attackers.

Meanwhile, security firms warn that AI-powered impersonation, social engineering, and phishing will continue to rise—especially as video call deepfakes and malware become more advanced and accessible.

What happened to Farooq is more than a personal tragedy—it’s a signpost. As digital finance grows, so do the risks. Trust—once a strength in Web3 circles—is now a vulnerability. In 2025, assuming “it won’t happen to me” may be the most dangerous thought of all.