<p><strong>On November 9, the software release system of Ethersphere was taken over by hackers who used it to send out malware using bee-js 13.3.0 and Swarm Desktop 0.56.2.</strong></p>
<p>This malware was <a href="https://x.com/ethswarm/status/2119764040008491491" rel="noopener noreferrer nofollow">programmed</a> to look for Bee node wallet private keys, thereby giving the hackers access to the affected devices. While the bee-js package stayed on npm for about 75 minutes, the Swarm Desktop release remained online for almost eight and a half hours.</p>
<h3 class="wp-block-heading" id="strong-signed-provenanced-and-still-malicious-strong"><strong>Signed, provenanced, and still malicious</strong></h3>
<p>The worrying part of this breach is that the software appeared legitimate. <a href="https://socket.dev/blog/bee-js-compromise" rel="noopener noreferrer nofollow">Cybersecurity firm Socket</a> confirmed that bee-js had valid SLSA provenance. Swarm Desktop’s macOS installer had been signed and Apple-notarized. It could be auto-updated for users of Apple Silicon and Windows.</p>
<p>Checks showed the origin of the software but not its safety. The hackers inserted malicious code into trusted workflows. Socket linked the hack to compromised GitHub accounts, including release bot bee-worker. However, how the access was obtained is still not known.</p>
<h3 class="wp-block-heading" id="strong-what-the-loader-steals-strong"><strong>What the loader steals</strong></h3>
<p><a href="https://www.stepsecurity.io/blog/ethersphere-bee-js-13-3-0-compromise?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">StepSecurity</a> discovered that attackers had modified scripts/generate-version.cjs to download malicious code from api.frameworkmetrics[.]xyz. The script ran automatically when developers installed bee-js 13.3.0, even if they never used the library.</p>
<p>The malware then searched for two files: config.yaml and data-dir/keys/swarm.key. The first contained the password needed to unlock the encrypted wallet key stored in the second. With both files, attackers could gain control of a Bee node wallet.</p>
<p>The malware also installed backdoors to maintain remote access. On Windows, it used ScreenConnect. On Linux and macOS, the backdoors masqueraded as legitimate Solidity development tools.</p>
<h3 class="wp-block-heading" id="strong-the-same-wallet-behind-sleepyduck-strong"><strong>The same wallet behind SleepyDuck</strong></h3>
<p>Socket has found that the malware <a href="https://socket.dev/blog/bee-js-compromise" rel="noopener noreferrer nofollow">made use of Ethereum contract</a> 0xf8a900Db50b3331be6B768bA460BB59f3E40C344 in order to find its command-and-control servers. Pluto Security had connected the same contract to the <a href="https://pluto.security/blog/sleepyduck-malware-open-vsx-extensions" rel="noopener noreferrer nofollow">SleepyDuck and EtherDuck campaigns</a>, which distributed malware using fake Solidity extensions.</p>
<p>However, in the present breach, the hackers have taken a different approach. They have attacked Ethersphere’s authentic software releases instead of convincing the developers to download fake software. The method resembles the previous npm supply-chain attack reported by Cryptopolitan, where hackers distributed <a href="https://www.cryptopolitan.com/attackers-arweaves-weavedb-npm-malware" rel="noopener noreferrer nofollow">malware through Arweave’s WeaveDB project packages</a>.</p>
<h3 class="wp-block-heading" id="strong-what-operators-need-to-do-now-strong"><strong>What operators need to do now</strong></h3>
<p>In two <a href="https://x.com/ethswarm/status/2119764040008491491" rel="noopener noreferrer nofollow">official</a><a href="https://x.com/ethswarm/status/2119764043888267514" rel="noopener noreferrer nofollow">notices</a>, Ethersphere identified both releases as malicious. Maintainer darkobas2 said in a <a href="https://github.com/ethersphere/swarm-desktop/pull/582" rel="noopener noreferrer nofollow">recovery pull request</a> that 0.56.2 “was built and published by an attacker using stolen CI credentials.” The clean replacement, 0.56.3, was “same code as 0.56.1,” signed with a new certificate.</p>
<p>Users should check their Desktop version and install <a href="https://github.com/ethersphere/swarm-desktop/releases/tag/v0.56.3" rel="noopener noreferrer nofollow">0.56.3</a>; Linux users must update manually. Anyone who ran the malware should isolate and rebuild the computer, move funds and stake from a clean device, and rotate credentials. bee-js users should pin 13.2.0. An update alone won’t remove a backdoor.</p>
<p>Socket <a href="https://socket.dev/blog/bee-js-compromise" rel="noopener noreferrer nofollow">recorded</a> 65 downloads of the tainted Desktop release by 08:27 UTC on November 9, including researchers, and estimated about ten bee-js 13.3.0 fetches. Neither is a victim count. No confirmed tally of infected machines or stolen funds exists.</p>
<figure class="wp-block-image size-large"><img width="1024" height="576" src="https://www.cryptopolitan.com/wp-content/uploads/2026/11/2026-Crypto-Incident-Rankings-1024x576.png" alt="">
 <figcaption><strong>Ethersphere bee-js and Swarm Desktop hack exposes wallet keys</strong>
 </figcaption>
</figure>
<h3 class="wp-block-heading" id="strong-reading-the-market-not-inventing-it-strong"><strong>Reading the market, not inventing it</strong></h3>
<p>On <a href="https://www.certik.com/certik-report/dashboard" rel="noopener noreferrer nofollow">CertiK’s dashboard</a>, wallet compromise ranks second by 2026 losses ($769.1 million) and third by incidents (75). Private-key compromise is fifth by losses ($158 million) and fourth by incidents (47). Those are industry-wide figures, not Ethersphere losses.</p>
<p><a href="https://www.coingecko.com/en/coins/swarm" rel="noopener noreferrer nofollow">CoinGecko</a> priced BZZ near $0.0654 on November 10, but no breach-driven selloff has been established. The bigger warning is about software trust: authentic updates can still steal keys.</p>
<p>The smartest crypto minds already read our newsletter. Want in? <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" rel="noopener noreferrer nofollow">Join them</a>.</p>

Hackers hijack Ethersphere’s bee-js and Swarm Desktop to steal wallet keys

Table of Contents

Cryptopolitan_News

Other articles published on Nov 10, 2026

Join our free newsletter for daily crypto updates!