Cyber Thieves Steal Wallets on Popular Cryptocurrency Exchange, Using Malicious Packages Published on Public Repositories.
A sophisticated cyber attack has hit the cryptocurrency exchange dYdX, with hackers using malicious packages published on public repositories to steal wallet credentials and backdoor devices. Researchers from security firm Socket have warned that every application using compromised npm versions is at risk of complete wallet compromise and irreversible cryptocurrency theft.
The attack was carried out by stealing seed phrases that underpin wallet security, along with device fingerprints, which allowed the threat actors to track victims across multiple compromises. The malicious code embedded a function in legitimate packages, allowing the thieves to exfiltrate sensitive information, including private keys and API credentials.
The packages were published on npm and PyPI repositories using official dYdX accounts, suggesting that they were compromised and used by the attackers. This is not the first time dYdX has been targeted in a cyber attack; previous incidents include malicious code uploaded to the npm repository in September 2022 and the commandeering of the dYdX v3 website through DNS hijacking in 2024.
The latest attack highlights a persistent pattern of adversaries targeting dYdX-related assets through trusted distribution channels. Researchers have warned that anyone using the platform should carefully examine all apps for dependencies on the malicious packages listed above, as they could be vulnerable to similar attacks.
The attackers used a remote access Trojan (RAT) that allowed them to execute new malware on infected systems, receive Python code from a C2 server, and use it in an isolated subprocess with no visible output. They also stole SSH keys, API credentials, and source code, and installed persistent backdoors.
This incident serves as a reminder of the importance of keeping software up-to-date and being cautious when using third-party libraries and dependencies to avoid falling prey to similar attacks.
A sophisticated cyber attack has hit the cryptocurrency exchange dYdX, with hackers using malicious packages published on public repositories to steal wallet credentials and backdoor devices. Researchers from security firm Socket have warned that every application using compromised npm versions is at risk of complete wallet compromise and irreversible cryptocurrency theft.
The attack was carried out by stealing seed phrases that underpin wallet security, along with device fingerprints, which allowed the threat actors to track victims across multiple compromises. The malicious code embedded a function in legitimate packages, allowing the thieves to exfiltrate sensitive information, including private keys and API credentials.
The packages were published on npm and PyPI repositories using official dYdX accounts, suggesting that they were compromised and used by the attackers. This is not the first time dYdX has been targeted in a cyber attack; previous incidents include malicious code uploaded to the npm repository in September 2022 and the commandeering of the dYdX v3 website through DNS hijacking in 2024.
The latest attack highlights a persistent pattern of adversaries targeting dYdX-related assets through trusted distribution channels. Researchers have warned that anyone using the platform should carefully examine all apps for dependencies on the malicious packages listed above, as they could be vulnerable to similar attacks.
The attackers used a remote access Trojan (RAT) that allowed them to execute new malware on infected systems, receive Python code from a C2 server, and use it in an isolated subprocess with no visible output. They also stole SSH keys, API credentials, and source code, and installed persistent backdoors.
This incident serves as a reminder of the importance of keeping software up-to-date and being cautious when using third-party libraries and dependencies to avoid falling prey to similar attacks.
dYdX got hacked AGAIN lol how many times do they gotta get pwned lol they use public repos to publish their own malicious packages who does that? 
anyway its super easy for ppl to fall victim if they dont keep their software updated & check 4 any suspicious dependencies u should def do urself a favor & delete those packages ASAP 
also dont even get me started on those seed phrases 
. I mean, who does that?! They're basically stealing people's lives and fortunes 
. One minute you're using your crypto exchange, the next minute your wallet is empty and you're left with nothing 
. And it's not just the money, it's the emotional toll too... like, can you imagine having to deal with the stress of losing all that? 
. Like, come on! If you're going to do something wrong, at least have the decency to keep it private, right? But no, these thieves just go ahead and publish their evil plans online for everyone to see 
.
. I mean, what even is the point of that?! They're not just stealing money and data, they're also basically taking control of people's systems 
.
. It's like, we all have to be vigilant against these cyber threats, or else... well, you don't even want to think about it 
.
cybersecurity is literally everyone's problem right now! idk how many ppl are gonna fall victim 2 these hackers & lose all their crypto lol what even is npm again? 
. And the worst part is, they stole seed phrases and device fingerprints, which basically means they can track you everywhere online! I mean, I know we should be careful with our passwords and all that, but this is just ridiculous 
I'm so sorry to hear that you're dealing with this kind of stress 
. It's just awful that these cyber thieves are preying on people's personal info and cryptocurrency wallets 
. The fact that they used malicious packages published on public repositories makes me really worried about the overall security of our online world 
but this time it's like they're making it easy for hackers to get in 
. Like, publishing malicious code on public repos? 
. I mean, who hasn't used third-party libraries or dependencies before 
? It's just so frustrating when you think you're being careful but then BAM! You've got hackers in your wallet 
. It's just crazy how quickly this stuff can spread 
.
. Keep our software up-to-date, check those dependencies, and don't be afraid to speak up if something seems sketchy 
. I've got a lot of respect for the devs at dYdX, but even they can't do everything on their own. It's all about keeping those dependencies up-to-date and being super careful when installing third-party stuff 
. But seriously, this is some scary stuff. I mean, if you're using dYdX or any other platform that relies on third-party code, you need to stay vigilant and keep an eye out for those malicious packages 
.
. I mean, who would've thought that malicious packages published on public repositories like npm could be used to steal wallet credentials? It's just another example of how vulnerable we are when it comes to cybersecurity. The fact that dYdX has been targeted multiple times already is not a good sign... 
like, who does that?