Disney

ERC20

<p class="is-style-lead">1inch, a decentralized exchange aggregator,&nbsp;was compromised after attackers injected malicious code into an animation library update, prompting users to connect their wallets to a crypto drainer.</p>
<p>On Oct. 30, 1inch users encountered malicious popups that appeared unexpectedly, urging them to connect their wallets. These prompts, embedded through compromised code in the popular Lottie Player animation library, redirected users to “Ace drainer” disguised as a standard <a href="https://crypto.news/approval-phishing-scams-a-much-bigger-problem-than-first-thought/" target="_blank" rel="noopener noreferrer nofollow">wallet connection request</a>, according to web3 security firm <a href="https://x.com/blockaid_/status/1851729469142372711" target="_blank" rel="noopener noreferrer nofollow">Blockaid</a>.</p>
<p>In its post-incident <a href="https://x.com/1inch/status/1851832307746742686" target="_blank" rel="noopener noreferrer nofollow">report</a>, 1inch noted that only its web dApp was affected, and all other platforms, including its mobile app and API services, remained unaffected. Without disclosing the extent of losses, the team hinted that some users may have been affected, but assured that losses would be refunded.</p>
<p>The developers have urged users to “revoke ERC20 approvals from malicious addresses” adding that they are “strengthening dependency management for enhanced security.”</p>
<p>You might also like: <a rel="noopener noreferrer nofollow" href="https://crypto.news/1inch-launches-fusion-upgrade-for-its-cross-chain-swaps/"> 1inch launches Fusion+ upgrade for its cross-chain swaps </a></p>
<h2 class="wp-block-heading" id="what-happened">What happened?</h2>
<p>According to cybersecurity researcher <a href="https://x.com/galnagli/status/1851779972639363076" target="_blank" rel="noopener noreferrer nofollow">Gal Nagli</a>, the breach stemmed from a large-scale supply chain attack on the Lottie Player animation library.</p>
<p>Lottie Player, widely used for web animations, is used by major companies like Apple, Spotify, and Disney for creating engaging user interfaces.</p>
<p>The attackers initially breached the GitHub account of a senior software engineer at LottieFiles, the publisher of the Lottie Player library. Using this access, the attackers pushed three malicious updates within a span of three hours. These updates contained code that injected a malicious popup into websites using the library.</p>
<p>While the attack, according to Nagli, was originally targeted towards web3 firms, he warned that other websites using the affected library versions remain vulnerable.&nbsp;</p>
<p>At press time, the affected libraries had been removed from GitHub, and users had been asked to upgrade to the latest version.</p>
<p>In an Oct. 31 X post, Cybersecurity firm Scam Sniffer noted that at least one victim had lost 10 BTC, worth roughly $723,436 at the time, after signing a phishing transaction.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">⚠️ 3 hours ago, a victim lost 10 BTC ($723,436) due to signing a phishing transaction.<br><br>This theft is likely related to the supply chain attack on Lottie Player earlier today. <a rel="noopener noreferrer nofollow" href="https://t.co/Puq5zUnKO9" target="_blank">https://t.co/Puq5zUnKO9</a> <a rel="noopener noreferrer nofollow" href="https://t.co/STYgRGgyK9" target="_blank">pic.twitter.com/STYgRGgyK9</a></p>— Scam Sniffer | Web3 Anti-Scam (@realScamSniffer) <a href="https://twitter.com/realScamSniffer/status/1851800628189933806?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">October 31, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<h2 class="wp-block-heading" id="the-complex-nature-of-crypto-scams">The complex nature of crypto scams</h2>
<p>On Oct. 17, Blockaid reported another attack where attackers pushed malicious code to <a href="https://crypto.news/circle-backed-decentralized-exchange-ambient-finance-faces-front-end-hack-blockaid/" target="_blank" rel="noopener noreferrer nofollow">compromise</a> Ambient Finance, a decentralized exchange. In that instance, attackers were reportedly using the Inferno Drainer kit.</p>
<p>In January, ScamSniffer <a href="https://crypto.news/web3-anti-scam-sleuth-uncovers-phishing-attack-that-drained-4-2m-using-a-malicious-opcode/" target="_blank" rel="noopener noreferrer nofollow">flagged</a> a phishing attack that exploited operation codes used in the scripting languages of various cryptocurrency platforms to drain $4.2 million worth of aEthWETH and aEthUNI.</p>
<p>Last year, the security firm <a href="https://crypto.news/malicious-script-in-google-and-x-stole-58m-in-crypto-from-over-63000-users/" target="_blank" rel="noopener noreferrer nofollow">reported</a> a wallet drainer employing a malicious script to target over 10,000 websites and steal crypto assets.</p>
<p>Over the years several wallet drainers have <a href="https://crypto.news/crypto-malware-angel-drainer-shuts-down-following-developer-identification-report/" target="_blank" rel="noopener noreferrer nofollow">shut down</a> due to security <a href="https://crypto.news/blockaid-fends-off-700k-in-losses-from-new-angel-drainer/" target="_blank" rel="noopener noreferrer nofollow">advancements</a> in the crypto space and the establishment of initiatives like SEAL 911. However, attackers continue to find <a href="https://crypto.news/post-mortem-reveals-stealthy-malware-injection-led-to-50m-radiant-capital-exploit/" target="_blank" rel="noopener noreferrer nofollow">new ways</a> to evade these defenses.</p>
<p>Read more: <a rel="noopener noreferrer nofollow" href="https://crypto.news/1inch-dao-proposes-150k-grant-to-create-web3-crowd-testing-platform/"> 1inch DAO proposes $150k grant to create web3 crowd testing platform </a></p>

1inch web app compromised, losses to be reimbursed

Table of Contents

crypto.news

Other articles published on Oct 31, 2024

OKX Ventures, The Open Platform, and Folius Ventures Launch $10M Telegram Growth Hub

Coinbase Faces Scrutiny Over $25M Donation to Fairshake PAC

Bitcoin Cash Rally in Sight: What’s Fueling BCH’s Path to $400

Qubetics Introduces Blockchain-Focused Leadership Team

OK DAO Treasury Fund Lock: Building Trust and Paving the Way for a Community-Driven, Multichain F...

Secret PR agency vows to expose Satoshi Nakamoto’s identity in London today

Join our free newsletter for daily crypto updates!