Real-capital social-engineering persona
A dev identity & insider risk factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score #
**What this measures** This factor flags when a "team contributor" or "external integrator" persona has deposited one million dollars or more of attributed real capital into the target protocol or peer protocols, where the deposits are assessed by the curator as credibility-building prior to a social-engineering attack rather than genuine investment activity. Measurement is manual OSINT combined with on-chain capital flow analysis: the curator identifies the contributor, maps their deposit history across protocols, and assesses whether the capital deployment pattern is consistent with investment behavior or with pre-attack credibility building. Category 7 context: real-capital persona construction is a sophisticated DPRK tactic documented first in the Drift Protocol incident.
**Why it matters** The Drift Protocol incident (April 2026, $285M) established this attack pattern: UNC4736 (DPRK-attributed) built a six-month conference and in-person engagement history with the Drift team, deploying more than $1M in real capital across protocol interactions to establish credibility as a genuine integrator before gaining access to enable the pre-signing exploit. This represents a qualitative escalation from the classic IT-worker infiltration playbook — real capital is used as a trust-building instrument. The signal is P1 (not P0) because attribution requires curator confidence beyond on-chain evidence alone; false positives occur when genuine large depositors also have team engagement roles.
**Green / Yellow / Red** Green is scored when no contributor or integrator persona has a capital deployment pattern assessed as credibility-building by the curator. Yellow applies when a contributor or integrator has made large deposits but the pattern is consistent with genuine investment and no other risk indicators are present. Red is scored when curator assessment confirms a persona with $1M+ deposits whose capital deployment timeline, combined with their subsequent access or influence pattern, is consistent with social-engineering credibility construction.
**Common gray cases** Gray is assigned when large-depositor identity cannot be confirmed through OSINT, or when the curator cannot distinguish investment behavior from credibility-building behavior within the evidence budget — which is the norm for most protocols.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Determine whether a curator-flagged "team contributor" or "external integrator" persona has ≥$1M of attributed real-capital deposits to the target protocol or peer protocols, potentially used to build credibility ahead of a social-engineering attack.