You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
`event-stream` npm package by Dominic Tarr was compromised because of a maintainer change.
21
21
Dominic Tarr stopped maintaining the repository long before the attack. The bad actor reached out
@@ -26,7 +26,7 @@ from applications and then released the malicious `event-stream` on npm. See
26
26
-[A bad link in the cryptochain](https://www.kaspersky.com/blog/copay-supply-chain-attack/24786/)
27
27
-[Widely used open source software contained bitcoin-stealing backdoor](https://arstechnica.com/information-technology/2018/11/hacker-backdoors-widely-used-open-source-software-to-steal-bitcoin/)
28
28
29
-
### Colourama attack (typosquatting), 2018
29
+
### 2. Colourama attack (typosquatting), 2018
30
30
31
31
End-user transaction attack through Pypi typosquatting by monitoring the clipboard for crypto addresses.
32
32
@@ -35,75 +35,82 @@ End-user transaction attack through Pypi typosquatting by monitoring the clipboa
35
35
-[Two new supply-chain attacks come to light in less than a week
"A single connection controlled by the non-secure processor allows it to reset the display. Hence, malicious code running on the non-secure processor can turn off the display even while it’s running on battery only. This might be leveraged as part of an elaborate social engineering attack where the infected Ledger Nano X shuts off its display while malware on a computer convinces the user to press a series of buttons to approve a malicious transaction (e.g., “Your Ledger Nano X stopped responding, please hold both buttons to restart the device”).
"On Friday, September 17, 2021, Miso suffered a supply chain exploit, whereupon the fund wallet address was fixed"
47
47
48
48
-[$3 million cryptocurrency heist stemmed from a malicious GitHub commit](https://blog.sonatype.com/3-million-cryptocurrency-heist-malicious-github-commit?hsLang=en-us)
49
49
50
-
### Onus attack (through Log4shell), 2021
50
+
### 5. Onus attack (through Log4shell), 2021
51
51
52
52
"The attackers were able to make off with the data before an update patching the Log4j vulnerability was available and demanded $5 million in ransom for the stolen information. [...] The attackers waited until 25 December 2021 for payment from ONUS, and when they did not receive the ransom, the attackers put the information of close to 2 million customers up for sale"
53
53
54
54
-[Vietnamese Crypto Trading Platform Hit with Log4j](https://redskyalliance.org/xindustry/vietnamese-crypto-trading-platform-hit-with-log4j)
"The Sysdig Threat Research Team (TRT) ... surfaced more than 1,600 malicious Docker images containing cryptominers, backdoors, and other nasty malware disguised as legitimate popular software."
59
59
60
60
-[Container Supply Chain Attacks Cash In on Cryptojacking](https://www.darkreading.com/attacks-breaches/container-supply-chain-attacks-cashing-in-on-cryptojacking)
61
61
-[Detecting cryptomining attacks “in the wild”](https://sysdig.com/blog/detecting-cryptomining-attacks-in-the-wild/)
The NPM account of dYdX, a popular decentralized cryptocurrency exchange, was compromised in 2022. The attackers gained access to dYdX's NPM account and published malicious versions of their legitimate packages. The compromised packages contained malware designed to steal cryptocurrency from users.
The attack targeted the @dydxprotocol scoped packages on the NPM registry. Once discovered, dYdX quickly revoked the compromised credentials and removed the malicious packages from NPM.
-[Popular Cryptocurrency Exchange dYdX Has Had Its NPM Account Hacked](https://www.mend.io/blog/popular-cryptocurrency-exchange-dydx-has-had-its-npm-account-hacked/)
"At around 17:49 UTC on 9 February 2023, Phylum’s automated risk detection platform began alerting us to a long series of suspicious publications which appear to be a revived attempt to deliver the same crypto wallet clipboard replacing malware. This time, however, the attacker changed the obfuscation technique and radically increased the volume of attacks."
The hackers compromised a Windows installer and targeted a few, very specific companies in the cryptocurrency business. Not clear how they managed to infect the installer file.
79
+
The hackers compromised a Windows installer and targeted a few, very specific companies in the cryptocurrency business. It is unknown how they managed to infect the installer file.
-[Not just an infostealer: Gopuram backdoor deployed through 3CX supply chain attack (Kaspersky)](https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/)
81
83
82
-
### Minecraft mods attack (package manager compromised), June 2023
84
+
### 10. Minecraft mods attack (package manager compromised), June 2023
83
85
84
86
"Participants posting in the forum said the malware used in the attack, dubbed Fracturiser, runs on Windows and Linux systems. It’s delivered in stages that are initiated by Stage 0, which begins once someone runs one of the infected mods. Each stage downloads files from a command-and-control server and then calls for the next stage. Stage 3, believed to be the final stage in the sequence, creates folders and scripts, makes changes to the system registry, and goes on to perform the following:
85
87
Propagate itself to all JAR (Java archive) files on the filesystem, Steal cookies and login information for multiple Web browsers, Replace cryptocurrency addresses in the clipboard with alternate ones, Steal Discord credentials, Steal Microsoft and Minecraft credentials"
86
88
87
89
Reference: [Dozens of popular Minecraft mods found infected with Fracturiser malware (arstechnica.com)](https://arstechnica.com/information-technology/2023/06/dozens-of-popular-minecraft-mods-found-infected-with-fracturiser-malware/)
88
90
89
-
### Fake ledger attack (fake app on app store) 2023
A malicious actor published a fake Ledger hardware wallet application on Microsoft's official App Store, impersonating the legitimate Ledger cryptocurrency wallet software.
94
+
95
+
Blockchain investigator ZachXBT identified and reported the fake app in December 2023. The malicious application remained available in the Microsoft App Store for some time despite multiple user reports, highlighting weaknesses in the app review process for official app marketplaces. This incident demonstrates how threat actors can leverage trusted distribution channels to target cryptocurrency users specifically.
90
96
91
-
Microsoft’s official App Store served up a Fake Ledger App on Microsoft App Store.
97
+
References:
98
+
-[Fake Ledger App Found on Microsoft App Store (zachxbt)](https://decrypt.co/204506/fake-ledger-app-microsoft-app-store-zachxbt)
99
+
-[Ledger Warning About Fake Apps](https://support.ledger.com/article/fraudulent-ledger-live-applications)
### Math.random() caused weak randomness until 2014 (prng issue) disclosed in 2023
103
+
### 12. Math.random() caused weak randomness until 2014 (prng issue) disclosed in 2023
96
104
97
105
BitcoinJS was widely used in early 2010s and the use of Math.random() potentially affects millions of cryptocurrency wallets that were generated in the 2011-2015 timeframe.
98
106
99
107
The main bug: the random number generator is seeded with Math.random() and the current time, granting at most ~40 bits of entropy. On-chain metadata discloses the creation time for any wallet hence all wallets created in the 2011-2015 time window on all major browsers, had problems.
Secbit has discovered that Trust Wallet did not correctly use a dependency (`trezor-crypto`), resulting in low entropy seed phrase generation. This vulnerability allowed attackers to predict private keys and drain user wallets.
122
128
123
-
### Attack through AI generated code, Nov 2024
129
+
The issue stemmed from improper initialization of the random number generator in the trezor-crypto library. Without sufficient entropy sources, the wallet generated predictable seed phrases that could be brute-forced much more easily than properly randomized ones.
124
130
125
-
@r_cky0 [reported](https://x.com/r_cky0/status/1859656430888026524) that ChatGPT generated code containing links to scamming website, incl. executable key exfiltration.
131
+
According to security researchers, multiple victims reported losing funds, with the total damage estimated to be in the millions of dollars.
### Bybit attack / Safe Javascript compromised Feb 2025
162
+
### 18. Bybit attack 8/ Safe Javascript compromised Feb 2025
156
163
157
-
The AWS account of a Safe developer was compromiser, the attacked uploaded malicious Javascript targeting a single wallet. The multisig signers signed a compromised transaction involving an [exploit contract](https://etherscan.io/address/0xbdd077f651ebe7f7b3ce16fe5f2b025be2969516) called with DELEGATE_CALL. This resulted in a $1.5B (billion!) theft on the cold wallet of the Bybit crypto exchange.
164
+
The AWS account of a Safe developer was compromise.r, the attacked uploaded m alicious Javascript targeting a single wallet. The multisig signers signed a compromised transaction involving an [exploit contract](https://etherscan.io/address/0xbdd077f651ebe7f7b3ce16fe5f2b025be2969516) called with DELEGATE_CALL. This resulted in a $1.5B (billion!) theft on the cold wallet of the Bybit crypto exchange.
158
165
159
166
Notes:
160
167
- This hack exploits a multisig cold wallet **without exploiting any smart contract vulnerability**.
0 commit comments