Switch

SwissBorg

Treat

<h2 id="crypto-hack-what-happened">Crypto Hack: What Happened?</h2>
<p>A widely used npm package, error-ex, was tampered with in its <strong>1.3.3 release</strong>. Hidden inside was obfuscated code that activates two dangerous attack modes:</p>
<ul>
 <li><strong>Clipboard Hijacking:</strong> When you paste a wallet address, the malware silently swaps it with the attacker’s lookalike address.</li>
 <li><strong>Transaction Interception:</strong> If you use a browser wallet, the code can intercept transaction calls and <strong>change the recipient’s address</strong> before you even see the confirmation screen.</li>
</ul>
<p>This makes it nearly impossible to notice unless you carefully check every single character of the address you’re sending to.</p>
<h2 id="who-s-at-risk-from-this-crypto-hack">Who’s at Risk from this Crypto Hack?</h2>
<ol>
 <li><strong>Developers:</strong> Any project pulling dependencies without strict version pinning may have installed the infected version. This could affect <strong>CI pipelines, production builds, and apps</strong> that rely on JavaScript.</li>
 <li><strong>Crypto Users:</strong> The malware targets major assets including $<a href="https://cryptoticker.io/en/token/price/BTC-USD/" rel="noopener noreferrer nofollow"><strong>BTC</strong></a><strong>, $ETH, $SOL, $TRX, $LTC, and $BCH</strong>. Both clipboard users and browser wallets are at risk.</li>
 <li><strong>Platforms:</strong> Even centralized apps integrating npm libraries may have unknowingly included the malicious code.</li>
</ol>
<h2 id="which-companies-were-affected">Which Companies were Affected?</h2>
<p>Already, <a href="https://swissborg.com/" rel="noopener noreferrer nofollow"><strong>SwissBorg</strong></a><strong> confirmed a breach</strong> linked to a compromised partner API. Roughly <strong>192.6K SOL (~$41.5M)</strong> was drained in the attack. While the SwissBorg app itself remains secure, its <strong>SOL Earn Program</strong> was hit, affecting &lt;1% of users. The platform has promised recovery measures, including treasury funds and support from white-hat hackers.</p>
<h2 id="how-to-protect-yourself">How to Protect Yourself</h2>
<p>Here’s what you need to do right now:</p>
<h3 id="for-wallet-users">For Wallet Users</h3>
<p>✅ Always verify every transaction — check the full recipient address before signing.<br>✅ Use a <a href="https://cryptoticker.io/en/comparison/hardware-wallets/" rel="noopener noreferrer nofollow"><strong>hardware wallet</strong></a> with clear signing enabled.<br>✅ Avoid unnecessary browser wallet extensions.<br>✅ If something feels off (unexpected signing requests), close the tab immediately.</p>
<h3 id="for-developers">For Developers</h3>
<p>⚙️ Switch CI builds from npm install to npm ci to lock dependencies.<br>⚙️ Run npm ls error-ex to detect infected installs.<br>⚙️ Pin safe versions (error-ex@1.3.2) and regenerate lockfiles.<br>⚙️ Add dependency scanners like <strong>Snyk</strong> or <strong>Dependabot</strong>.<br>⚙️ Treat package-lock changes with the same scrutiny as code reviews.</p>
<h2 id="outlook">Outlook</h2>
<p>This incident highlights the <strong>fragility of supply chains in Web3 and beyond</strong>. A small package compromise can cascade into billions of downloads, hitting both developers and crypto holders worldwide. The immediate danger lies in <strong>address-swapping attacks</strong>, but the broader concern is how deep this could spread into financial infrastructure.</p>
<p>For now: <strong>check before you sign, pin your dependencies, and don’t take security shortcuts.</strong></p>

Breaking News: Crypto Funds at Risk from Massive Supply Chain Attack

Table of Contents

CryptoTicker ENG

Other articles published on Sep 8, 2025

Join our free newsletter for daily crypto updates!