Bitcoin

when

Bubble

Avalanche

Lottie Player was hit with a supply chain attack, affecting one wallet with 10 Bitcoin (BTC). The Wordpress tool has been abused to send malicious links to Web3 users, effectively draining wallets.&nbsp; 
Lottie Player, the Wordpress animation library, has been used as a vector of attack for Web3 users. Through malicious links, at least one wallet has been drained of 10 Bitcoin (BTC).&nbsp; 
The Lottie Player attack has affected widely used projects like 1inch and Mover. The 1inch attack may be especially harmful, as the DEX trading service is among the most widely used ones on Ethereum.&nbsp; 
Blockaid has also reported it has been spreading malicious wallet connections through its website. <a href="https://x.com/BubbleStatus/status/1851740380049609213" rel="nofollow" target="_blank">Bubble</a> was another front-facing website affected by the malicious popups, and became one of the first to be reported. Bubble is also the source for building third-party apps, which could have been affected in the hours when the old versions were active.&nbsp; 
Researchers from Blockaid have <a href="https://x.com/blockaid_/status/1851732916960727049" rel="nofollow" target="_blank">identified</a> Ace Drainer as the most probable source of the attack. The malicious version of Lottie Player has been removed, but not before spreading fake links for signing with widely used Web3 wallets. The attack has been active for at least 12 hours, increasing the balances in several identified attack wallets. 
<figure id="attachment_607560" aria-describedby="caption-attachment-607560" style="width: 100%" class="wp-caption alignnone">
 <img decoding="async" class="wp-image-607560 size-full" src="https://www.cryptopolitan.com/wp-content/uploads/2024/10/LottieOctober312024.png" alt="Lottie player hit with a supply chain attack, stealing 10 wrapped BTC from Avalanche wallet" width="858" height="897" srcset="https://www.cryptopolitan.com/wp-content/uploads/2024/10/LottieOctober312024.png 858w, https://www.cryptopolitan.com/wp-content/uploads/2024/10/LottieOctober312024-287x300.png 287w, https://www.cryptopolitan.com/wp-content/uploads/2024/10/LottieOctober312024-768x803.png 768w" sizes="(max-width: 858px) 100vw, 858px">
 <figcaption id="caption-attachment-607560" class="wp-caption-text">
 Lottie Player launched a popup asking to connect a crypto wallet. | Source: <a href="https://github.com/LottieFiles/lottie-player/issues/254" rel="nofollow noopener" target="_blank">GitHub</a>
 </figcaption>
</figure> 
The attack was first noted when a wallet got drained of 10 BTC, leading to the source of fake links. The risk was in quickly signing all requests, including permanent access to wallets. This allowed the attackers to even drain Avalanche C-Chain addresses, stealing a form of <a href="https://snowscan.xyz/tx/0xdd2e5cfb6de4ca4f23adb6d2d36d4b94b306cd91b00bc237f1812f3af6b8136a" rel="nofollow noopener" target="_blank">wrapped BTC</a>. The attack itself did not ask for a self-custodial Bitcoin wallet, but relied on the need for Web3 connectivity. 
<blockquote class="twitter-tweet" data-theme="dark"> 
 ⚠️ 3 hours ago, a victim lost 10 BTC ($723,436) due to signing a phishing transaction. 
 This theft is likely related to the supply chain attack on Lottie Player earlier today. <a href="https://t.co/Puq5zUnKO9" rel="nofollow" target="_blank">https://t.co/Puq5zUnKO9</a> <a href="https://t.co/STYgRGgyK9" rel="nofollow" target="_blank">pic.twitter.com/STYgRGgyK9</a> 
 — Scam Sniffer | Web3 Anti-Scam (@realScamSniffer) <a href="https://twitter.com/realScamSniffer/status/1851800628189933806?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">October 31, 2024</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
Users also noted the Lottie Player would populate a Web3 route with a malicious transaction when used for websites in the usual way. Analysts noted the attack targeted Ethereum and EVM-compatible chains.&nbsp; 
The attackers’ addresses continue to show activity, affecting small holdings of various Web3 tokens. For now, the entire size of the attack has not been accounted, and may have affected other tokens. The attackers are <a href="https://app.nansen.ai/profiler?address=0xf244a12fcf3dbcede0183e41b78e12b04d292654&amp;name=0xf244a12fcf3dbcede0183e41b78e12b04d292654&amp;chain=ethereum&amp;tab=transactions" rel="nofollow noopener" target="_blank">swapping</a> the tokens quickly through Uniswap, or even through MetaMask swap. 
<h3 id="span-style-font-weight-400-lottie-player-attack-spread-to-multiple-sites-span">Lottie Player attack spread to multiple sites</h3> 
The Lottie Player attack displayed a very familiar screen for Web3 users, urging them to connect some of the top wallets, including MetaMask, WalletConnect, and others. 
Even the <a href="https://x.com/RealTryHackMe/status/1851744593269637129" rel="nofollow" target="_blank">TryHackMe</a> platform experienced the popup, but moved to an older version. The issue has been reported by other users of popular websites.&nbsp; 
The attack affected two versions of Lottie Player, first noticed late on October 30. The attacks originated from versions 2.0.5 or higher. Website owners had to clear the attack themselves in the initial hours, by reverting to other tools or older versions of Lottie Player. Some have chosen to delete the scripts as a precaution.&nbsp; 
Wallet owners may still have to revoke permissions, if they have connected to any of the injected links. Sites like <a href="https://www.cryptopolitan.com/1inch-links-bruce-lees-family-to-foster-defi/">1inch</a> draw in more than 590K monthly users, and may have affected multiple undetected wallets. 
<h3 id="span-style-font-weight-400-lottie-player-team-publishes-safe-version-span">Lottie Player team publishes safe version</h3> 
The Lottie Player team reacted by uploading a legitimate new version 2.0.8, while <a href="https://x.com/LottieFiles/status/1851848602093777273" rel="nofollow" target="_blank">unpublishing</a> the contaminated scripts. The team noted the faulty versions were three in total, published directly to NPM using a compromised access token from a developer with the required publishing privileges. The team notes no other repositories or libraries have been affected.&nbsp; 
Lottie Player is widely used for animations and minor features on websites, but has been added to the list of distributors for malicious links. Those types of attacks target individual wallets, adding to the risk of <a href="https://www.cryptopolitan.com/chainalysis-wallets-address-poisoning-scam/">poisoned addresses</a>, direct targeting in email and messages, and fake website versions.&nbsp; 
The attack happens during the next stage of a crypto bull market, accelerating attempts to steal more valuable tokens. Connecting a wallet is best done for a specific purpose, avoiding full-time permissions for signing transactions. Launching a wallet connection immediately after entering a website may be a red flag.

Lottie Player hit with a supply chain attack, stealing 10 wrapped BTC from Avalanche wallet

Table of Contents

Cryptopolitan_News

Other articles published on Oct 31, 2024

Altcoin Sprinting Ahead of Rivals With a 100% Bonus Code as its Seed Round $105.5M; Bittensor Pri...

BREAKING: Coinbase Announces New Altcoin Listing on Futures

Post-Election Clarity Could Ignite Ethereum, Altcoin Rally: Bitwise CIO

Shiba Inu Price on Verge Amid 800 Billion SHIB Whale Sell-Off

Top 5 Trading Strategies

Bitcoin Set to Surge Past $100,000 After Upcoming Election

Join our free newsletter for daily crypto updates!