pwn.watch: Crypto incident updates

[high] GlassWorm: self-spreading VS Code / OpenVSX extension worm hidden in invisible Unicode

Fri, 31 Oct 2025 00:00:00 GMT

Koi Security found extensions on OpenVSX (and one on Microsoft's marketplace) carrying JavaScript hidden in invisible Unicode variation selectors. The malware stole npm, GitHub, Git and OpenVSX credentials to infect more extensions, went after crypto wallets, and set up SOCKS proxies and hidden VNC.

Status: closed · Patch: patched · Fixed in: Malicious releases removed from the marketplaces

Latest updates:

2025-10-20: Wider coverage; Microsoft marketplace extension also affected (source)
2025-10-17: Koi Security discloses GlassWorm on OpenVSX (source)

[critical] chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email

Mon, 15 Sep 2025 00:00:00 GMT

Maintainer Josh Junon (qix) was phished by a fake npm 2FA-reset email from npmjs.help. The attacker published malicious versions of 18 packages, including chalk, debug, ansi-styles and strip-ansi, with code that hijacked crypto wallet transactions in browsers. They were live for about two hours.

Status: closed · Patch: patched · Fixed in: chalk 5.6.2, ansi-styles 6.2.3, strip-ansi 7.1.2, supports-color 10.2.2, ansi-regex 6.2.2, wrap-ansi 9.0.2, slice-ansi 7.1.2, has-ansi 6.0.2, chalk-template 1.1.2, supports-hyperlinks 4.1.2, debug and others: republished by the maintainer on 2025-09-13

Latest updates:

2025-09-15: Initial CVEs posted (source)
2025-09-13: All remaining affected packages republished by the maintainer (source)
2025-09-08: Malicious versions start appearing on npm (13:16 UTC) (source)

[high] Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused

Fri, 30 May 2025 00:00:00 GMT

Criminals bribed overseas support staff to pull customer data (names, contact details, partial financial data, ID images, balances and transactions), then demanded $20M. Coinbase refused, offered a matching bounty, and estimated $180M to $400M in costs. No passwords, private keys or funds were accessed directly.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-05-15: Coinbase discloses the breach in an SEC filing and refuses the $20M ransom (source)
2025-05-11: Coinbase receives the extortion demand and discovers the breach (source)
2025-05: Breach notice puts affected customers at 69,461 (source)

[critical] Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)

Thu, 06 Mar 2025 00:00:00 GMT

North Korean TraderTraitor/Lazarus hackers compromised a Safe{Wallet} developer's Mac, took over AWS session tokens and injected JavaScript into Safe's S3-hosted frontend. Bybit's signers approved what looked like a routine transfer but was a malicious transaction. It is the largest crypto theft on record; the FBI attributed it to North Korea.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-03-06: Safe{Wallet} confirms a developer machine compromise by TraderTraitor (source)
2025-02-26: FBI attributes the theft to North Korea ('TraderTraitor') (source)
2025-02-21: About $1.5B in ETH drained from a Bybit cold wallet

[high] @solana/web3.js npm package backdoored to steal private keys

Wed, 04 Dec 2024 00:00:00 GMT

A publish-access account for @solana/web3.js was compromised. Malicious versions 1.95.6 and 1.95.7, live on npm from 15:20 to 20:25 UTC on 2024-12-03, exfiltrated private key material from apps and bots that handle keys directly. Non-custodial wallets were generally not affected. Fixed in 1.95.8.

Status: closed · Patch: patched · Fixed in: 1.95.8

Latest updates:

2024-12-04: GitHub advisory GHSA-jcxm-7wvp-g6p5 published; upgrade to 1.95.8 (source)
2024-12-03: Malicious 1.95.6 and 1.95.7 published to npm (15:20-20:25 UTC), then unpublished (source)

CVEs: CVE-2024-54134

[high] @lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer

Thu, 31 Oct 2024 00:00:00 GMT

A LottieFiles developer's npm access was abused to publish @lottiefiles/lottie-player 2.0.5, 2.0.6 and 2.0.7 on 2024-10-30. Sites loading the 'latest' build from CDNs like unpkg and jsDelivr showed a wallet-connect popup that tried to drain visitors' crypto wallets. LottieFiles unpublished the versions and released 2.0.8, a copy of 2.0.4.

Status: closed · Patch: patched · Fixed in: 2.0.8

Latest updates:

2024-10-30: Malicious 2.0.5, 2.0.6 and 2.0.7 pushed to npm; users report a wallet popup (source)
2024-10-30: LottieFiles removes the compromised access, unpublishes the versions and publishes 2.0.8 (source)

[critical] Ledger Connect Kit npm package hijacked to drain crypto wallets

Thu, 14 Dec 2023 00:00:00 GMT

Attackers phished a former Ledger employee's npm account and published malicious @ledgerhq/connect-kit versions 1.1.5 to 1.1.7. Because many dApps load it from a CDN without pinning a version, their users were shown wallet-drainer prompts. Ledger shipped a clean 1.1.8 within about 40 minutes of finding out.

Status: closed · Patch: patched · Fixed in: 1.1.8

Latest updates:

2023-12-14: Malicious connect-kit versions published to npm via a phished ex-employee account; Ledger ships 1.1.8 and the npm versions are removed (source)

[high] Retool breach: SMS phishing, deepfaked voice call and synced MFA codes

Wed, 13 Sep 2023 00:00:00 GMT

An attacker phished a Retool employee by SMS, then called them with a deepfaked voice to get an MFA code. Because Google Authenticator synced codes to the employee's Google account, the attacker got their MFA codes too, and took over 27 cloud customer accounts, all in crypto.

Status: closed · Patch: no-fix-needed

Latest updates:

2023-09-13: Retool publishes its write-up (source)
2023-08-27: SMS phishing and voice call lead to compromise of a Retool employee account and 27 cloud customers (source)

[high] JumpCloud breached by North Korean hackers to reach crypto customers

Thu, 20 Jul 2023 00:00:00 GMT

A spear-phishing attack let a nation-state actor into JumpCloud's infrastructure. The attacker abused its command framework to target a small set of customers. JumpCloud force-rotated all customer API keys, and researchers tied the attack to North Korea, aimed at crypto companies.

Status: closed · Patch: no-fix-needed

Latest updates:

2023-07-20: SentinelOne links the intrusion infrastructure to North Korean APT activity (source)
2023-07-12: JumpCloud publishes incident details and indicators (source)
2023-07-05: JumpCloud rotates all customer API keys (source)