Bitcoin ETF

The front-end websites of several online crypto apps were compromised on Oct. 30 after attackers injected malicious code into an update of a popular and widely used animation library.
Decentralized finance <a data-ct-non-breakable="null" href="https://cointelegraph.com/learn/what-are-dapps-everything-there-is-to-know-about-decentralized-applications" rel="noopener noreferrer nofollow" target="null" text="null" title="null">apps</a>, including 1inch and TEN Finance, showed popups asking users to connect their wallet, which was actually for the crypto drainer “Ace Drainer,” crypto security platform Blockaid said in an Oct. 30 X <a data-ct-non-breakable="null" href="https://x.com/blockaid_/status/1851729469142372711" rel="noopener noreferrer nofollow" target="null" text="null" title="null">post</a>.
Gal Nagli, a security lead at cybersecurity firm Wiz, <a data-ct-non-breakable="null" href="https://x.com/galnagli/status/1851779972639363076" rel="noopener noreferrer nofollow" target="null" text="null" title="null">explained</a> the compromise was from a “massive supply chain attack” on the Lottie Player library — a hugely popular service that provides animations for sites and apps, boasting users like Apple, Spotify, and Disney.
<figure><img alt="Hackers, Scams, Hacks" src="https://s3.cointelegraph.com/uploads/2024-10/0192e04e-4a7d-7a2c-9ae8-4e015ada5cc0" title="">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/blockaid_/status/1851731367920374147" rel="noopener noreferrer nofollow" target="null" text="null" title="https://x.com/blockaid_/status/1851731367920374147">Blockaid</a>
 </figcaption>
</figure>
The attack is unique as it injected a malicious popup into a seemingly otherwise unaffected website. Attackers <a data-ct-non-breakable="null" href="https://cointelegraph.com/learn/crypto-hacks-and-scams" rel="noopener noreferrer nofollow" target="null" text="null" title="null">typically</a> breach highly-followed social media accounts to trick followers into clicking phishing links on <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/misspelling-soneium-google-shows-crypto-phishing-link-scam-sniffer" rel="noopener noreferrer nofollow" target="null" text="null" title="null">fake website</a>s.
Jawish Hameed, the engineering vice president at LottieFiles — the firm that publishes the animations library — <a data-ct-non-breakable="null" href="https://github.com/LottieFiles/lottie-player/issues/254#issuecomment-2448685876" rel="noopener noreferrer nofollow" target="null" text="null" title="null">wrote</a> on GitHub the affected library versions had been removed and urged users to install the latest version.
He <a data-ct-non-breakable="null" href="https://github.com/LottieFiles/lottie-player/issues/254#issuecomment-2448643837" rel="noopener noreferrer nofollow" target="null" text="null" title="null">said</a> that <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/truth-terminal-founder-x-account-hacked-promotes-scam-memecoin" rel="noopener noreferrer nofollow" target="null" text="null" title="null">attackers compromised</a> the GitHub account of a LottieFiles’ senior software engineer and pushed three malicious updates in three hours, adding it had “removed the compromised account access.”
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/hacker-sec-bitcoin-etf-tweet-not-guilty-plea-deal" rel="noopener noreferrer nofollow" target="null" text="null" title="null">Hacker behind fake Bitcoin ETF X post pleads not guilty</a>
Wiz’s Nagli said users were seeing the <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/fake-curve-finance-app-scams-users-tops-finance-charts" rel="noopener noreferrer nofollow" target="null" text="null" title="null">malicious crypto wallet</a> connection popup “on popular websites all across the internet.”
“It seems that the original attack intent was to target major crypto websites who utilize the library,” he added.
Nagli warned that websites that still use the affected library versions “are probably still vulnerable,” saying users should check if sites are using the non-malicious packages — either version 2.0.4 or the latest 2.0.8.
LottieFiles did not immediately respond to a request for comment.
Crypto-Sec: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/pythia-finance-drained-53k-crypto-sec/" rel="noopener noreferrer nofollow" target="null" text="null" title="null">2 auditors miss $27M Penpie flaw, Pythia’s ‘claim rewards’ bug</a>

Crypto apps see malicious popups after Ace Drainer hacks animation library

Cointelegraph

Other articles published on Oct 31, 2024

Whale Moves 1 Trillion Pepe To Binance As DTX Exchange Set To Launch Revolutionary Wallet

OK DAO Treasury Fund Lock: Building Trust and Paving the Way for a Community-Driven, Multichain F...

Ellipsis Labs raises $21m round led by Haun Ventures

Hong Kong Stock Exchange to Launch Unified Bitcoin and Ethereum Index

JUST IN! Binance Announces Listing of a New Altcoin! Price Jumps!

Sui Announces Integration with Google Cloud to Boost Real-Time Blockchain Data Access

Join our free newsletter for daily crypto updates!