Cryptocurrency Exchange Under Attack: Thieves Steal Wallets by Infecting Open-Source Packages
Hackers have struck again, targeting the cryptocurrency exchange dYdX with a particularly devious attack. The scammers managed to infect open-source packages published on the npm and PyPI repositories, compromising wallet credentials and even backdooring devices.
According to researchers at security firm Socket, malicious code was embedded in the legitimate packages, which stole seed phrases used for wallet security and even device fingerprints. This allowed the attackers to track victims across multiple compromises. The compromised packages included version 3.4.1 of the @dydxprotocol/v4-client-js package on npm and a single version, 1.1.5post1, of the dydx-v4-client package on PyPI.
The attack is particularly insidious because it relies on the trust that developers have in open-source packages. The malicious code was uploaded by official dYdX accounts, suggesting that they had been compromised and used by the attackers.
Perpetual trading and perpetual targeting are the hallmarks of this latest attack, as the hackers seek to exploit vulnerabilities in the exchange's code libraries. The exchange provides third-party apps for trading bots, automated strategies, or backend services, all of which handle sensitive data such as private keys.
The researchers warned that every application using the compromised npm versions is at risk, and that direct impact includes complete wallet compromise and irreversible cryptocurrency theft. The attack scope also includes all applications depending on the compromised versions, whether they use real credentials or production end-users.
This is not the first time dYdX has been targeted in an attack. Previous incidents include a September 2022 upload of malicious code to the npm repository and a 2024 DNS hijacking incident where users were redirected to a malicious site designed to drain their wallets.
The latest attack highlights a persistent pattern of adversaries targeting dYdX-related assets through trusted distribution channels. The researchers urged anyone using the platform to carefully examine all apps for dependencies on the malicious packages listed above, in order to avoid falling victim to this cunning scam.
Hackers have struck again, targeting the cryptocurrency exchange dYdX with a particularly devious attack. The scammers managed to infect open-source packages published on the npm and PyPI repositories, compromising wallet credentials and even backdooring devices.
According to researchers at security firm Socket, malicious code was embedded in the legitimate packages, which stole seed phrases used for wallet security and even device fingerprints. This allowed the attackers to track victims across multiple compromises. The compromised packages included version 3.4.1 of the @dydxprotocol/v4-client-js package on npm and a single version, 1.1.5post1, of the dydx-v4-client package on PyPI.
The attack is particularly insidious because it relies on the trust that developers have in open-source packages. The malicious code was uploaded by official dYdX accounts, suggesting that they had been compromised and used by the attackers.
Perpetual trading and perpetual targeting are the hallmarks of this latest attack, as the hackers seek to exploit vulnerabilities in the exchange's code libraries. The exchange provides third-party apps for trading bots, automated strategies, or backend services, all of which handle sensitive data such as private keys.
The researchers warned that every application using the compromised npm versions is at risk, and that direct impact includes complete wallet compromise and irreversible cryptocurrency theft. The attack scope also includes all applications depending on the compromised versions, whether they use real credentials or production end-users.
This is not the first time dYdX has been targeted in an attack. Previous incidents include a September 2022 upload of malicious code to the npm repository and a 2024 DNS hijacking incident where users were redirected to a malicious site designed to drain their wallets.
The latest attack highlights a persistent pattern of adversaries targeting dYdX-related assets through trusted distribution channels. The researchers urged anyone using the platform to carefully examine all apps for dependencies on the malicious packages listed above, in order to avoid falling victim to this cunning scam.
they just want to make it easy for us to trade but noooo thieves always find a way 
my brother actually got hit by one of these attacks last year and he lost like a thousand dollars 
it was so frustrating for him and i'm worried now because i use crypto too... anyway just gotta be super careful when using third-party apps and make sure they haven't been compromised 
I'm totally freaking out about this one guys... so like you know how we use open-source packages for our fave tools and stuff? well some hackers are using those same packages to STEAL OUR WALLET CREDENTIALS 
The worst part is that dYdX had no idea their own accounts were compromised... talk about a security fail! 
So yeah, just be super careful out there folks and check all your apps for any suspicious dependencies. Your wallet (and life) depends on it 
. I don't get why developers trust those open-source packages so much... shouldn't they do some extra checks or something? Anyway, let's all just be careful and make sure to update our apps ASAP 
. I'm not surprised that hackers figured out how to infect open-source packages and wreak havoc on dYdX users' wallets tho... it's like we're living in a bad hacking movie 
. And the worst part is that they used legit developer accounts to upload the malicious code, so no one was even thinking twice about it 
. I mean, can't we just have one day without our personal info getting breached? 
It's like a never-ending cat-and-mouse game, where one side just gets more and more clever.
It's like a domino effect - one bad thing leads to another, and it's hard to stop the chain reaction.
. Take the time to check your apps for suspicious dependencies, you know? 
It's not that hard, and it could save you a lot of trouble in the end 
. And now, any app that uses those packages is at risk 
. This kind of attack has happened before, and dYdX has been targeted multiple times 
. So yeah, be careful out there and check your apps for dependencies on those malicious packages 
.
. Can't we just get a secure internet without all these risks? 
. By infecting open-source packages and exploiting developer trust, the attackers were able to gain access to sensitive data and compromise wallet credentials. It's chilling to think that the malicious code was uploaded by official dYdX accounts, highlighting the potential for insider threats 
. As the cryptocurrency landscape continues to evolve, it's essential that developers and users remain vigilant and take proactive steps to protect themselves against such attacks 
.
.
. What I'm worried about now is how many people are affected by this. Like, if someone's wallet got compromised because of a bot on their phone, they're gonna lose everything 
.
. wallet compromise, irreversible theft... just terrible 
. gotta be super careful now 
. dont wanna get pwned again 
. The fact that dYdX devs were compromised and uploaded malicious code themselves is just mind-blowing 
.
, so let's keep our guard up and double-check everything