Radiant Capital lost $50M to this exact chain in October '24 — Lazarus DM'd a dev posing as a former contractor, ran a fake Zoom that dropped the payload, compromised enough multisig signers to forge the transfer call. Every macOS-using signer on every protocol is the target profile, and a Ledger on the desk doesn't save you when the machine approving the tx is owned. Recruiter DM → "quick call" is the attack surface now, not the solidity code.

Top comment by @Benthic