Bitget CEO Sounds Alarm on Rising Zoom and Teams Phishing Threat to Crypto

Bitget CEO Gracy Chen has warned of a fast-spreading wave of fake Zoom and Microsoft Teams meeting invitations that are being used to steal crypto from industry professionals.

The notices, sent through Telegram and bogus Calendly pages, attempt to trick victims into installing malware disguised as a “network update.”

Kidnapping of Chinese Travel Blogger Intensifies Security Fears

Chen described how the hackers operate in a December 9 post on X. According to her, it starts with users receiving fake links to what appears to be a standard business meeting. Once in the call, the criminals reportedly use pretexts like poor audio quality or connection problems to persuade the target to download a supposed software update or SDK.

This file is actually malware designed to steal passwords and private keys, a method famously used by the Lazarus group, an advanced persistent threat (APT) organization reportedly linked to the North Korean regime.

The crypto exchange executive’s comments came shortly after Chinese travel blogger Lan Zhanfei went public about being kidnapped in South Africa.

According to Lan, the kidnappers spent six months preparing the attack, bribed hotel and airport staff, broke into his room, and forced him to collect biological samples while threatening to kill him if he didn’t fly back to China.

Multiple posts circulating on Weibo and X described Lan as a high-profile travel influencer known for extreme expeditions and large online followings. One widely shared Facebook post said he was held for hours inside a Cape Town hotel, forced to take nude photos, and made to sign debt agreements. Lan later thanked the Chinese Embassy for intervening and relocating him, with his IP address later showing Chile.

You may also like:

• Crypto Firms Commit HK$57M in Immediate Aid After Hong Kong’s Deadliest Fire
• North Korea’s Crypto Theft Reaches $2.83B Since 2024
• Bunni DEX Shuts Down Following $8.4M Hack

While Chen did not claim the kidnapping was crypto-related, she tied the incident to a broader pattern of targeted crimes against online personalities and blockchain users. In her warning, she stressed that attackers have begun impersonating Bitget representatives and pointed to a fraudulent Telegram account using her name, as well as a fake “calendly.com/bitgetglobal” page.

Her message urged users to double-check all meeting links, avoid installing any software pushed during calls, and report suspicious contacts to security teams immediately. She added that spreading the warning could prevent more users from falling victim to similar traps.

A Growing Pattern of Physical and Digital Crypto Attacks

Lan’s ordeal has come during a troubling period for crypto-linked violence, highlighted by cases in Minnesota and Paris reported earlier this year.

In Minnesota, two brothers were charged in September after allegedly holding a family hostage at gunpoint for nine hours and forcing a victim to move $8 million in crypto. Meanwhile, French police arrested five suspects in August after a Paris man was abducted near the Arc de Triomphe and robbed of a hard drive holding €2 million in Bitcoin.

Both cases drew attention to the way digital assets can become targets for traditional criminals once wallets or holdings are known.