Someone pretending to be a senior CoinDesk executive spent the weeks after Hacker Summer Camp doing exactly what you’d expect a villain to do after the heroes go home: hunting the hunters.
A threat actor operating under the X handle @HartmansDoeke impersonated CoinDesk’s vice president and reached out to multiple cybersecurity researchers around August 9, 2026, pitching them on participation in a fake online conference about cryptocurrency. The lure was a Google Doc rigged with a custom Google Apps Script designed to fingerprint victims’ machines and deliver platform-specific malware.
How the attack worked
The campaign was documented by researchers at Huntress, one of whose team members deliberately engaged the attacker to study the operation without executing any harmful payloads.
Initial contact came via public replies and direct messages on X. The attacker invited targets to join what appeared to be a legitimate panel discussion on crypto topics, a reasonable proposition given that these researchers had just attended Black Hat and DEF CON in Las Vegas.
