Crypto
Security incidents tagged Crypto. Newest first.
0 Crypto incidents in the last 12 months
- Incidents
- 9
- Live
- 0
- Patched
- 9
- Days without an incident
- 356
- Longest quiet run: 367 days (Oct 21–Oct 22)
Show 9 older incidents9 older incidents
October 2025 1
HighGlassWorm: self-spreading VS Code / OpenVSX extension worm hidden in invisible UnicodePatched
VS Code extensions on OpenVSX and the VS Code Marketplace Patched
Koi Security found extensions on OpenVSX (and one on Microsoft's marketplace) carrying JavaScript hidden in invisible Unicode variation selectors. The malware stole npm, GitHub, Git and OpenVSX credentials to infect more extensions, went after crypto wallets, and set up SOCKS proxies and hidden VNC.
September 2025 1
- CriticalPatched
chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email
Maintainer Josh Junon (qix) was phished by a fake npm 2FA-reset email from npmjs.help. The attacker published malicious versions of 18 packages, including chalk, debug, ansi-styles and strip-ansi, with code that hijacked crypto wallet transactions in browsers. They were live for about two hours.
npm: chalk, debug, ansi-styles, strip-ansi, supports-color and 13 moreClosed Sep 13, 2025
May 2025 1
HighCoinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refusedNo fix needed
Coinbase customer support systems No fix needed
Criminals bribed overseas support staff to pull customer data (names, contact details, partial financial data, ID images, balances and transactions), then demanded $20M. Coinbase refused, offered a matching bounty, and estimated $180M to $400M in costs. No passwords, private keys or funds were accessed directly.
February 2025 1
- CriticalNo fix needed
Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)
North Korean TraderTraitor/Lazarus hackers compromised a Safe{Wallet} developer's Mac, took over AWS session tokens and injected JavaScript into Safe's S3-hosted frontend. Bybit's signers approved what looked like a routine transfer but was a malicious transaction. It is the largest crypto theft on record; the FBI attributed it to North Korea.
Bybit cold wallet / Safe{Wallet} web UIClosed Mar 6, 2025
December 2024 1
High@solana/web3.js npm package backdoored to steal private keysPatched
@solana/web3.js (npm) Patched
A publish-access account for @solana/web3.js was compromised. Malicious versions 1.95.6 and 1.95.7, live on npm from 15:20 to 20:25 UTC on 2024-12-03, exfiltrated private key material from apps and bots that handle keys directly. Non-custodial wallets were generally not affected. Fixed in 1.95.8.
Open incident →CVE-2024-54134
October 2024 1
High@lottiefiles/lottie-player npm package hijacked with a crypto wallet drainerPatched
@lottiefiles/lottie-player (npm) Patched
A LottieFiles developer's npm access was abused to publish @lottiefiles/lottie-player 2.0.5, 2.0.6 and 2.0.7 on 2024-10-30. Sites loading the 'latest' build from CDNs like unpkg and jsDelivr showed a wallet-connect popup that tried to drain visitors' crypto wallets. LottieFiles unpublished the versions and released 2.0.8, a copy of 2.0.4.
December 2023 1
- CriticalPatched
Ledger Connect Kit npm package hijacked to drain crypto wallets
Attackers phished a former Ledger employee's npm account and published malicious @ledgerhq/connect-kit versions 1.1.5 to 1.1.7. Because many dApps load it from a CDN without pinning a version, their users were shown wallet-drainer prompts. Ledger shipped a clean 1.1.8 within about 40 minutes of finding out.
@ledgerhq/connect-kit (npm)Closed Dec 14, 2023
August 2023 1
HighRetool breach: SMS phishing, deepfaked voice call and synced MFA codesNo fix needed
Retool (cloud) No fix needed
An attacker phished a Retool employee by SMS, then called them with a deepfaked voice to get an MFA code. Because Google Authenticator synced codes to the employee's Google account, the attacker got their MFA codes too, and took over 27 cloud customer accounts, all in crypto.
June 2023 1
HighJumpCloud breached by North Korean hackers to reach crypto customersNo fix needed
JumpCloud (directory / device management SaaS) No fix needed
A spear-phishing attack let a nation-state actor into JumpCloud's infrastructure. The attacker abused its command framework to target a small set of customers. JumpCloud force-rotated all customer API keys, and researchers tied the attack to North Korea, aimed at crypto companies.
