Breaking News: Crypto Funds at Risk from Massive Supply Chain Attack
Crypto Hack: What Happened?
A widely used npm package, error-ex, was tampered with in its 1.3.3 release. Hidden inside was obfuscated code that activates two dangerous attack modes:
- Clipboard Hijacking: When you paste a wallet address, the malware silently swaps it with the attacker’s lookalike address.
- Transaction Interception: If you use a browser wallet, the code can intercept transaction calls and change the recipient’s address before you even see the confirmation screen.
This makes it nearly impossible to notice unless you carefully check every single character of the address you’re sending to.
Who’s at Risk from this Crypto Hack?
- Developers: Any project pulling dependencies without strict version pinning may have installed the infected version. This could affect CI pipelines, production builds, and apps that rely on JavaScript.
- Crypto Users: The malware targets major assets including $ BTC , $ETH, $SOL, $TRX, $LTC, and $BCH. Both clipboard users and browser wallets are at risk.
- Platforms: Even centralized apps integrating npm libraries may have unknowingly included the malicious code.
Which Companies were Affected?
Already, SwissBorg confirmed a breach linked to a compromised partner API. Roughly 192.6K SOL (~$41.5M) was drained in the attack. While the SwissBorg app itself remains secure, its SOL Earn Program was hit, affecting <1% of users. The platform has promised recovery measures, including treasury funds and support from white-hat hackers.
How to Protect Yourself
Here’s what you need to do right now:
For Wallet Users
✅ Always verify every transaction — check the full recipient address before signing.
✅ Use a hardware wallet with clear signing enabled.
✅ Avoid unnecessary browser wallet extensions.
✅ If something feels off (unexpected signing requests), close the tab immediately.
For Developers
⚙️ Switch CI builds from npm install to npm ci to lock dependencies.
⚙️ Run npm ls error-ex to detect infected installs.
⚙️ Pin safe versions (error-ex@1.3.2) and regenerate lockfiles.
⚙️ Add dependency scanners like Snyk or Dependabot.
⚙️ Treat package-lock changes with the same scrutiny as code reviews.
Outlook
This incident highlights the fragility of supply chains in Web3 and beyond. A small package compromise can cascade into billions of downloads, hitting both developers and crypto holders worldwide. The immediate danger lies in address-swapping attacks, but the broader concern is how deep this could spread into financial infrastructure.
For now: check before you sign, pin your dependencies, and don’t take security shortcuts.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
US CPI Heats Up Across the Board, Triggering "Inflation Spiral" Alert; October Rate Hike Odds Once Hit 50%. "New Fed News Agency": Watch Waller's Speech This Week
After the CPI was released, the market-implied rate hike probability first rose to 50% before falling back to 40%. Wall Street generally believes that whether action will be taken in October still depends on how the Federal Reserve assesses inflation trends. "The New Fed News Agency" noted that, unlike in August when price increases were concentrated in certain items, the stronger-than-expected performance of September's core CPI was more broad-based, further reinforcing the case for a December rate hike. The speech by Waller on Friday morning Beijing time is his last public statement before the Fed's blackout period ahead of this month's meeting. Economists are warning about an "inflation spiral," with real purchasing power and midterm election pressures interweaving.
The calm period in the US stock market is over! The S&P 500 ends its record of 53 consecutive trading days without a drop of over 1%. AI stock sell-off intensifies market concerns.
The S&P 500 Index fell by 1.1%, ending a streak of 53 consecutive trading days without a drop of 1% or more. This was the longest period of calm since January 2020.
Federal Reserve Beige Book: U.S. economy expands moderately but inflationary pressures intensify; AI boosts productivity curbing some corporate hiring demand
The latest Beige Book released by the Federal Reserve on Wednesday shows that overall economic activity in the United States continues to grow, but performance varies across regions. Consumer spending remains generally weak, and there has been little change in the labor market.
Overnight US Stocks | September Inflation Remains High, Major Indexes Decline, Coreweave (CRWV.US) Drops Over 15%
At the close, the Dow Jones Industrial Average fell by 47.96 points, or 0.09%, to 51,622.14 points; the S&P 500 Index dropped by 85.95 points, or 1.10%, to 7,719.50 points; and the Nasdaq Composite Index declined by 511.51 points, or 1.88%, to 26,692.87 points.
Crypto prices
More
