Hackers have only managed to steal $50 worth of crypto from a massive supply chain hack affecting JavaScript software libraries, industry security researchers say. Crypto intelligence platform Security Alliance <a href="https://www.securityalliance.org/news/2025-09-npm-supply-chain" rel="noopener noreferrer nofollow" target="_blank">shared</a> the findings on Monday after hackers broke into the node package manager (NPM) account of a well-known software developer and <a href="https://bsky.app/profile/bad-at-computer.bsky.social/post/3lydioq5swk2y" rel="noopener noreferrer nofollow" target="https://bsky.app/profile/bad-at-computer.bsky.social/post/3lydioq5swk2y">added</a> malware to popular JavaScript libraries that have already been downloaded over 1 billion times, potentially putting countless crypto projects at risk. Ethereum and Solana wallets were specifically targeted, Security Alliance said. Fortunately, less than $50 has been stolen from the crypto space so far, the security firm said, identifying Ethereum wallet address “0xFc4a48” as what it believes to be the only malicious address so far. It <a href="https://x.com/_SEAL_Org/status/1965142759213584812" rel="noopener noreferrer nofollow" target="_blank">added</a> on X:
<blockquote>
 ”Picture this: you compromise the account of a NPM developer whose packages are downloaded more than 2 billion times per week. You could have unfettered access to millions of developer workstations. Untold riches await you. The world is your oyster. You profit less than 50 USD.”
</blockquote>
<figure>
 <img alt="Largest NPM attack in crypto history stole less than $50: SEAL" src="https://s3.cointelegraph.com/uploads/2025-09/01992b4c-9f4b-7eda-9021-1850d037005d" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/_SEAL_Org/status/1965142760660562210" rel="noopener noreferrer nofollow" target="_blank">Security Alliance</a>
 </figcaption>
</figure>
 “The hacker didn’t fully capitalize on the amount of access they had. It’s like finding the keycard to Fort Knox and using it as a bookmark. The malware was widespread but at this point is nearly completely neutralized,” pseudonymous SEAL security researcher Samczsun told Cointelegraph in a separate comment. The $50 figure was, however, <a href="https://x.com/_SEAL_Org/status/1965147035344273718" rel="noopener noreferrer nofollow" target="_blank">bumped</a> up from five cents a few hours earlier, suggesting the potential damage may still be unfolding.
<h2 id="eth-memecoin-among-small-amount-of-crypto-stolen">ETH, memecoin among small amount of crypto stolen</h2>
The five cents stolen were in Ether (<a href="/ethereum-price" rel="noopener noreferrer">ETH</a>) while another $20 worth of a memecoin was compromised, Security Alliance said. Etherscan <a href="https://etherscan.io/address/0xFc4a4858bafef54D1b1d7697bfb5c52F4c166976#tokentxns" rel="noopener noreferrer nofollow" target="_blank">data</a> shows the malicious address has received Brett (<a href="/brett-price-index" rel="noopener noreferrer">BRETT</a>), Andy (ANDY), Dork Lord (DORK), Ethervista (VISTA), and Gondola (GONDOLA) memecoins so far.
<h2 id="crypto-projects-that-didn-t-download-the-npms-still-at-risk">Crypto projects that didn’t download the NPMs still at risk</h2>
The breach targeted packages such as&nbsp;chalk,&nbsp;strip-ansi,&nbsp;and&nbsp;color-convert&nbsp;— small utilities buried deep in the dependency trees in countless projects. Even devs who never installed them directly could be exposed.
NPM is like an app store for developers — a central library where they share and download small code packages to build JavaScript projects. Related: <a href="https://cointelegraph.com/news/pokemon-cards-could-have-polymarket-moment" rel="noopener noreferrer nofollow" target="https://cointelegraph.com/news/pokemon-cards-could-have-polymarket-moment">Pokémon cards will soon have their ‘Polymarket moment’ — Bitwise</a>
The attackers appear to have planted a&nbsp;crypto-clipper, a type of malware that silently replaces wallet addresses during transactions to divert funds. Ledger chief technology officer Charles Guillemet was among many who have urged crypto users to proceed with caution when confirming onchain transactions.
<h2 id="ledger-metamask-among-crypto-apps-not-affected">Ledger, MetaMask among crypto apps not affected</h2>
Crypto wallet providers <a href="https://x.com/Ledger/status/1965172338657259898" rel="noopener noreferrer nofollow" target="_blank">Ledger</a> and <a href="https://x.com/MetaMask/status/1965147403713196304" rel="noopener noreferrer nofollow" target="_blank">MetaMask</a> marked their platforms as safe from the NPM attack — pointing to “multiple layers of defense” to protect against such attacks.
The team behind <a href="https://x.com/phantom/status/1965135301514527174" rel="noopener noreferrer nofollow" target="_blank">Phantom</a> Wallet said it doesn’t use any vulnerable versions of the affected packages, while <a href="https://x.com/Uniswap/status/1965162488233930800" rel="noopener noreferrer nofollow" target="_blank">Uniswap</a> noted that none of its apps are at risk.
<a href="https://x.com/AerodromeFi/status/1965197648635506756" rel="noopener noreferrer nofollow" target="_blank">Aerodrome,</a> <a href="https://x.com/blast/status/1965191683769073812" rel="noopener noreferrer nofollow" target="_blank">Blast,</a> <a href="https://x.com/BlockstreamJade/status/1965147418242269232" rel="noopener noreferrer nofollow" target="_blank">Blockstream Jade</a> and <a href="https://x.com/RevokeCash/status/1965126434403373532" rel="noopener noreferrer nofollow" target="_blank">Revoke.cash</a> were among the other crypto platforms that said they were unaffected by the supply chain attack.
<figure>
 <img alt="Software, Malware, Cybersecurity, Developers" src="https://s3.cointelegraph.com/uploads/2025-09/01992c15-c618-7c2a-ba04-79d75d849c60" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/MetaMask/status/1965147403713196304" rel="noopener noreferrer nofollow" target="_blank">MetaMask</a> 
 </figcaption>
</figure>
<h2 id="you-won-t-be-instantly-drained-crypto-founder-says">You won’t be instantly drained, crypto founder says</h2>
0xngmi, the pseudonymous founder of crypto analytics platform DefiLlama, however <a href="https://x.com/0xngmi/status/1965125988016087050" rel="noopener noreferrer nofollow" target="_blank">said</a> only crypto projects that updated after the malware-infected NPM package was published may be at risk. Even then, users must approve the malicious transaction for it to work. Though like Guillemet, he said it may be safer to avoid using crypto websites until developers behind those platforms clean up the bad packages.
Magazine: <a href="https://cointelegraph.com/magazine/chatgpt-linked-murder-suicide-after-accidental-jailbreak-ai-eye/" rel="noopener noreferrer nofollow" target="_self">‘Accidental jailbreaks’ and ChatGPT’s links to murder, suicide: AI Eye</a>

Largest NPM attack in crypto history stole less than $50: SEAL

Table of Contents

Cointelegraph

Other articles published on Sep 8, 2025

Join our free newsletter for daily crypto updates!