OAK-T15 — Off-chain Entry-Vector / Pre-Positioning

Description

Off-chain Entry-Vector / Pre-Positioning covers the kill-chain phase before any on-chain action — the social-engineering, supply-chain, endpoint, credential, and communication-channel compromises that adversaries execute against operator-side personnel and infrastructure to obtain the off-chain authority, code-injection foothold, or audience-control surface that a downstream T11 / T9 / T10 / T4 event will then exercise on-chain. The defining property of a T15 sub-Technique is that the compromised surface is not the on-chain protocol itself; it is an off-chain surface (a developer's workstation, a vendor's build pipeline, a domain registrar, a Discord operator account) whose state controls what the on-chain protocol will execute, sign, or display.

T15 is intentionally distinct from T4 (Access Acquisition). T4 covers the on-chain artefact of misused authority — the Approval, setApprovalForAll, or Permit2 signature whose grantee is attacker-controlled, the WalletConnect session that has been hijacked, the address-poisoning entry that the victim copies. The defender signal at T4 is on-chain (the granted authority object is publicly observable). T15 covers the off-chain compromise that produces the conditions under which a victim or operator grants those authorities — a fake-job-offer payload that compromises a developer's workstation, an npm package whose post-install script exfiltrates .env keys, a hijacked X account that distributes a phishing link to the operator's audience. The defender signal at T15 is off-chain (vendor disclosure, mailbox forensics, package-registry timeline, account-recovery logs). The two tactics are linked one-to-many: a single T15.x pre-position may produce many downstream T4.x extractions, and a single downstream T4.x signature may have multiple plausible T15.x antecedents.

T15 is also distinct from T11 (Custody and Signing Infrastructure). T11 covers the resulting on-chain extraction event when a custody-or-signing-pipeline surface has been compromised — the Bybit transfer from cold wallet, the Atomic Wallet user-base drain, the WazirX multisig-contract modification. T15 covers the upstream compromise that produced the conditions for that T11 event — the social-engineering of the Safe{Wallet} developer (T15.001), the build-pipeline injection at the wallet vendor (T15.002), the developer-workstation compromise at the customer organisation (T15.003). Splitting these across two Tactics makes the kill-chain read correctly: a Bybit-class incident is now T15.001 → T15.003 → T11.001 (entry vector → endpoint state → on-chain extraction), and a defender reasoning about which mitigation surface to invest in can pick by Tactic rather than by paragraph inside a single Technique page.

T15 sits before T4 and T11 in the kill-chain ordering. v0.1 OAK had to document T15-class events as off-chain footnotes inside T11.001 / T11.002 / T4.005 worked-example pages because no Tactic-level home existed; this Tactic closes that gap.

What defenders observe

• Off-chain disclosure of social-engineering campaigns targeting operator personnel — LinkedIn fake-recruiter messaging, Telegram impersonation of trusted contractors, fake-investor / fake-trading-bot lures, fake-coding-test deliveries that drop a payload on the developer's workstation. The defender signal is in the recruiter-pretext mailbox, the LinkedIn / Telegram message archive, and the post-event endpoint forensic record.
• Vendor-side disclosure of supply-chain compromise at a build / distribution / authentication pipeline that downstream operators depend on — a wallet vendor's CI/CD injection, an npm package's post-install backdoor, a signing-platform's UI build-pipeline compromise. The defender signal is in the vendor's incident report, the package-registry version-history record, the build-artefact integrity check.
• Endpoint-state evidence on developer / signer / operator workstations — installed persistence implants, MITM layers between the wallet UI and the broadcast channel, browser extensions exfiltrating credentials, malicious second-stage tooling whose teardown is anti-forensic. The defender signal lives in EDR / MDM telemetry and post-event device forensics.
• Operator-credential compromise events at SSO / cloud / domain-registrar / DNS / package-registry surfaces — registrar-API password reuse, MFA-fatigue / push-bombing, session-cookie theft, OAuth-token compromise, X / Discord / Telegram account-recovery anomalies. The defender signal is in the IDP audit log, the registrar account-activity record, the social-platform account-recovery audit.
• Operator-controlled communication-channel takeover events — Discord moderator account compromise, X account compromise, Telegram channel admin compromise — distributing a malicious link or message to the operator's audience under the credibly-held operator brand. The defender signal is in the platform's account-recovery audit and the post-event timeline of the malicious-payload distribution window.

Relationship to other tactics

T15 is the producer-side Tactic for downstream T4 / T11 / T9 / T10 events. The shape of the kill-chain that T15 makes legible is:

• T15.001 → T11.001 / T11.003 is the canonical 2024-2025 OAK-G01 supply-chain wave (DMM Bitcoin, WazirX, Radiant Capital, Bybit, Drift Protocol). The off-chain social-engineering of operator personnel produces the conditions for the on-chain extraction event.
• T15.002 → T11.001 / T11.002 is the canonical wallet-vendor / signing-vendor / dev-tooling supply-chain class (Atomic Wallet, Ledger Connect Kit, Solana web3.js, Polymarket trader-tooling, Bybit / Safe{Wallet} build pipeline).
• T15.003 is the endpoint-state Tactic component — the developer workstation or signing machine whose compromise is the proximate enabler of the T11 extraction. T15.001 (the social-engineering vector) typically produces T15.003 (the resulting endpoint state); the two are paired but distinct because the mitigation surface is different (anti-phishing controls vs EDR / signing-host hardening).
• T15.004 → T4.002 / T9.004 / T10.001 is the credential-compromise class (Curve DNS-hijack, Galxe DNS, CoinStats Snap, validator-key custody compromises that flow through SSO / cloud-account compromise rather than through a dev-machine implant).
• T15.005 → T4.005 / T4.002 is the operator-communication-channel takeover class — Discord / X / Telegram operator account compromise distributing a malicious link to the operator's audience, producing downstream setApprovalForAll / Permit / signature-phishing extractions against the audience members.

T15 mitigation is concentrated at the off-chain operational-security layer — anti-phishing training for privileged staff (OAK-M21), build-pipeline integrity controls, signing-host air-gap (OAK-M19), out-of-band destination verification at sign time (OAK-M18), credential-rotation discipline post-disclosure (OAK-M22), domain-registrar / DNS / package-registry hardening, and operator-side communication-channel SOP (allowlist of channels, mandatory mod-verification, multi-channel cross-confirmation of high-stakes announcements). The dollar-loss-prevented metric for T15 is most sensitive to time-to-detection of the off-chain compromise — every T15-class incident publicly documented at v0.1 had hours-to-weeks of pre-positioning before the on-chain event.

Sub-Techniques

• OAK-T15.001 — Social Engineering of Operator Personnel
• OAK-T15.002 — Supply-Chain / Vendor-Pipeline Compromise
• OAK-T15.003 — Operator-Endpoint Compromise (Developer Workstation / Signing Machine)
• OAK-T15.004 — Operator-Side Credential Compromise (SSO / Cloud / Registrar / DNS / Package Registry)
• OAK-T15.005 — Operator-Communication-Channel Takeover (Discord / X / Telegram)

Discussion

The core editorial question this Tactic answers: why split T15 out of T11 / T4 rather than continue documenting these events as adjuncts inside the on-chain Tactic where their downstream extraction lives? The answer is operational, not taxonomic.

A defender reading T11.001 at v0.1 was reading a Technique page that conflated the on-chain extraction event (a single large outflow from cold wallet, signatures cryptographically valid) with the off-chain entry vector (LinkedIn fake-job-offer payload, developer-workstation MITM layer, Safe{Wallet} build-pipeline compromise). The mitigation surfaces for these two layers are structurally different — the T11.001 on-chain layer is an out-of-band-destination-verification and wallet-cluster-attribution problem; the off-chain layer is an anti-phishing-training and build-pipeline-integrity problem. Vendors and customer organisations evaluating their exposure needed to enumerate both surfaces independently, but a single Technique page covering both made the enumeration awkward and consistently produced worked-example pages that footnoted the off-chain vector without giving it Tactic-level visibility.

T15 makes the kill-chain read correctly. A Bybit-class incident now reads as T15.001 (LinkedIn / Telegram social engineering) → T15.003 (Safe{Wallet} developer workstation in compromised state) → T11.001 (on-chain extraction with cryptographically valid signatures). A Ronin-class incident reads as T15.001 → T15.003 → T10.001. A Curve DNS-hijack incident reads as T15.004 → T4.002. A 2022-04 BAYC Discord wave reads as T15.005 → T4.005. The Tactic boundary is the layer at which the defender signal and the mitigation surface live: off-chain (T15) vs on-chain (T4 / T9 / T10 / T11).

T15 is also the OAK editorial response to the v0.1 TAXONOMY-GAPS observation that the largest single class of public crypto theft (DPRK-attributed CEX, custody, wallet-vendor, and developer-workstation compromises) had a load-bearing off-chain entry-vector phase that the on-chain Tactic taxonomy did not surface at the Tactic level. T11's introduction in v0.1 closed half of this gap by giving custody-and-signing-pipeline compromise a first-class Tactic; T15 closes the other half by giving the upstream entry-vector phase its own Tactic. Together they give the OAK kill-chain a complete left-to-right read for the supply-chain attack class.

Maturity boundary: T15 sub-Techniques in v0.1 are all emerging. Promotion to stable will require ≥3 anchor cases per sub-Technique with multi-vendor agreement on the boundary against adjacent sub-Techniques (T15.001 vs T15.003, T15.002 vs T15.003, T15.004 vs T15.005). The operator-side credential-compromise and operator-communication-channel-takeover sub-Techniques (T15.004 / T15.005) in particular have boundary cases — e.g., an X-account compromise via cloud-credential reuse could plausibly map to either — that future contributors should adjudicate case-by-case and document on the Technique page rather than collapse into a single sub-Technique.

T15 does not include attacks against end-user social channels, end-user wallets, or end-user devices when the proximate victim is the wallet-holder rather than the operator — those cases are T4 (on-chain authority misuse) and T11.x sub-Techniques covering user-side seed-phrase / hardware-wallet compromise. The T15 boundary is operator-side: the compromised surface is controlled by the entity whose downstream on-chain authority is being misused, not by the eventual on-chain victim.

Maintainer notes

T15 is an explicit response to the v0.1 observation in TAXONOMY-GAPS.md that worked examples for Bybit, Atomic Wallet, Ronin, Concentric, Radiant Capital, DMM Bitcoin, and the operator-Discord-takeover cohort consistently documented their off-chain entry-vector phase under T11 / T4 paragraphs that did not generalise across vectors. Adding T15 lifts the entry-vector phase to Tactic-level so the kill-chain reads correctly and so future worked examples can map to the upstream-vs-downstream Tactic split without forcing reviewers to choose between "T11 with off-chain footnote" and "T4 with off-chain footnote."

Per VERSIONING.md, adding T15 is an additive schema change (schema-minor bump): existing IDs are unchanged, and existing T11.x / T4.x worked-example mappings are preserved. The anchor worked examples carry both the existing on-chain Technique mapping AND the new T15.x cross-reference, so downstream consumers pinned to the v0.1 schema continue to resolve the existing IDs without breakage.

Future T15 contributions should preserve two boundary rules:

• Operator-side, not user-side. T15 is the off-chain compromise of an operator-controlled surface (developer workstation, vendor build pipeline, registrar credential, operator Discord). User-side seed-phrase compromise / hardware-wallet compromise stays in T11.x sub-Techniques anchored at the user-side cohort.
• Pre-position, not extraction. T15 is the upstream phase. The on-chain extraction event itself stays in T4 / T9 / T10 / T11. A worked example that maps only to T15.x without a downstream on-chain Technique is incomplete; T15 only makes sense as part of a chain.