Movement

Strike

Impact

ERC20

<p>This comes as a major shock to the crypto industry. </p>   
<p>In a major coordinated attack on the web3 space, on-chain sleuths discovered a massive supply chain attack on Lottie Player earlier today. The LottieFiles team reported that attackers injected malicious code into several versions of Lottie Player, including 2.05, 2.06, and 2.0.7, which were published on GitHub’s npm platform.</p>   
<blockquote class="wp-block-quote">
  
 <p><em>“The unauthorized versions contained code that prompted for connecting to user’s crypto wallets. A large number of users using the library via third-party CDNs without a pinned version were automatically served the compromised version as the latest release,”</em> the LottieFiles team <a href="https://x.com/lottiefiles/status/1851848602093777273?s=46">noted</a>.&nbsp;</p> 
</blockquote>   
<h2 class="wp-block-heading" id="h-users-at-risk-here-s-what-was-done">Users at Risk? Here's What Was Done</h2>   
<p>The LottieFiles team is currently investigating the incident, suspecting that a developer with the necessary privileges facilitated the attack. They have since released a new secure version, called 2.0.8, which is a copy of the original Lottie Player version 2.0.4.</p>   
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
   https://twitter.com/galnagli/status/1851779972639363076?s=46 
 </div>
</figure>   
<p>To prevent further harm, the LottieFiles team has unpublished the compromised package versions from the npm platform. They also removed all access and associated service accounts of the impacted developer.</p>   
<h2 class="wp-block-heading" id="h-impact-of-the-lottie-player-supply-chain-attack">Impact of the Lottie Player Supply Chain Attack</h2>   
<p>According to the on-chain analysis platform Scam Sniffer, the Lottie Player supply chain attack affected major decentralized applications (DApps), including 1inch (1INCH) and Movement Network. The attackers aimed to drain users' funds, prompting the 1inch protocol to pledge refunds to all affected users through its network.</p>   
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
   https://twitter.com/realscamsniffer/status/1851781579141714376?s=46 
 </div>
</figure>   
<p>In response to the attack, the 1inch team has urged all impacted users to revoke ERC20 smart contract approvals from malicious addresses using revoke.cash to avoid further losses. On-chain data analysis revealed that a web3 user lost 10 Bitcoins, worth over $720,000, earlier today due to the Lottie Player supply chain attack.</p>   
<p><strong>As the dust settles on this attack, one question remains: What's next for the web3 world?</strong></p>

Lottie Player Crypto Hack: Major DApps Attacked, Users Lose $720K

Table of Contents

CoinPedia News

Other articles published on Oct 31, 2024

Will Polkadot Surpass Ethereum, Solana, and Cardano in 2025

Crypto funding rounds broke $2B in October, led by Animoca Brands

Why We Won’t See CBDCs Everywhere

Solana’s Road to $1000? Whales Bet Big on A Hot New Crypto in Bull Market Surge

Solana (SOL) Meme Coin Bonk (BONK) Faces Tough Competition From Cutoshi (CUTO) In Q4

Do Betting Odds Know Best?

Join our free newsletter for daily crypto updates!