Bitget App
Trade smarter
Buy cryptoMarketsTradeFuturesEarnSquareMore
Breaking News: Crypto Funds at Risk from Massive Supply Chain Attack

Breaking News: Crypto Funds at Risk from Massive Supply Chain Attack

CryptotickerCryptoticker2025/09/09 04:54
By:Cryptoticker

Crypto Hack: What Happened?

A widely used npm package, error-ex, was tampered with in its 1.3.3 release. Hidden inside was obfuscated code that activates two dangerous attack modes:

  • Clipboard Hijacking: When you paste a wallet address, the malware silently swaps it with the attacker’s lookalike address.
  • Transaction Interception: If you use a browser wallet, the code can intercept transaction calls and change the recipient’s address before you even see the confirmation screen.

This makes it nearly impossible to notice unless you carefully check every single character of the address you’re sending to.

Who’s at Risk from this Crypto Hack?

  1. Developers: Any project pulling dependencies without strict version pinning may have installed the infected version. This could affect CI pipelines, production builds, and apps that rely on JavaScript.
  2. Crypto Users: The malware targets major assets including $ BTC , $ETH, $SOL, $TRX, $LTC, and $BCH. Both clipboard users and browser wallets are at risk.
  3. Platforms: Even centralized apps integrating npm libraries may have unknowingly included the malicious code.

Which Companies were Affected?

Already, SwissBorg confirmed a breach linked to a compromised partner API. Roughly 192.6K SOL (~$41.5M) was drained in the attack. While the SwissBorg app itself remains secure, its SOL Earn Program was hit, affecting <1% of users. The platform has promised recovery measures, including treasury funds and support from white-hat hackers.

How to Protect Yourself

Here’s what you need to do right now:

For Wallet Users

✅ Always verify every transaction — check the full recipient address before signing.
✅ Use a hardware wallet with clear signing enabled.
✅ Avoid unnecessary browser wallet extensions.
✅ If something feels off (unexpected signing requests), close the tab immediately.

For Developers

⚙️ Switch CI builds from npm install to npm ci to lock dependencies.
⚙️ Run npm ls error-ex to detect infected installs.
⚙️ Pin safe versions ([email protected]) and regenerate lockfiles.
⚙️ Add dependency scanners like Snyk or Dependabot.
⚙️ Treat package-lock changes with the same scrutiny as code reviews.

Outlook

This incident highlights the fragility of supply chains in Web3 and beyond. A small package compromise can cascade into billions of downloads, hitting both developers and crypto holders worldwide. The immediate danger lies in address-swapping attacks, but the broader concern is how deep this could spread into financial infrastructure.

For now: check before you sign, pin your dependencies, and don’t take security shortcuts.

0
0

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

PoolX: Earn new token airdrops
Lock your assets and earn 10%+ APR
Lock now!

You may also like

From yen rate hikes to mining farms shutting down, why is bitcoin still falling?

The recent decline in bitcoin prices is primarily driven by expectations of a rate hike by the Bank of Japan, uncertainty regarding the US Federal Reserve's rate cut trajectory, and systemic de-risking by market participants. Japan's potential rate hike may trigger the unwinding of global arbitrage trades, leading to a sell-off in risk assets. At the same time, increased uncertainty over US rate cuts has intensified market volatility. In addition, selling by long-term holders, miners, and market makers has further amplified the price drop. Summary generated by Mars AI This summary was generated by the Mars AI model, and the accuracy and completeness of its content are still being iteratively updated.

MarsBit2025/12/16 04:27
From yen rate hikes to mining farms shutting down, why is bitcoin still falling?

The Economist: The Real Threat of Cryptocurrency to Traditional Banks

The crypto industry is replacing Wall Street's privileged status within the American right-wing camp.

ForesightNews 速递2025/12/16 04:23
The Economist: The Real Threat of Cryptocurrency to Traditional Banks

SCOR partners with Edison Chen to launch "The 888 Continuum"—a phased on-chain campaign where in-game "superpowers" unlock exclusive CLOT sneaker drops, gear, and digital collectibles.

SCOR announced today a major strategic partnership with creative director, cultural icon, and CLOT founder Edison Chen.

ForesightNews2025/12/16 03:02
SCOR partners with Edison Chen to launch "The 888 Continuum"—a phased on-chain campaign where in-game "superpowers" unlock exclusive CLOT sneaker drops, gear, and digital collectibles.
© 2025 Bitget