A new cyberattack is silently targeting crypto from users during transactions amid an incident that security researchers describe as the largest supply chain attack in history.

BleepingComputer reported that hackers compromised NPM package maintainer accounts through phishing emails and injected malware that steals crypto.

The attack targeted JavaScript developers with fraudulent emails appearing to originate from “[email protected],” an impersonated domain mimicking the legitimate NPM registry.

The phishing messages warned maintainers that their accounts would be locked on Sept. 10, unless they updated their two-factor authentication credentials through a malicious link.

Attackers successfully compromised 18 widely-used JavaScript packages with collective weekly downloads exceeding 2.6 billion.

The compromised libraries include fundamental development tools such as “chalk” (300 million weekly downloads), “debug” (358 million), and “ansi-styles” (371 million), affecting virtually the entire JavaScript ecosystem.

Targeting crypto

The malicious code operates as a browser-based interceptor, monitoring network traffic for crypto transactions across Ethereum, Bitcoin, Solana, Tron, Litecoin, and Bitcoin Cash networks.

When users initiate crypto transfers, the malware silently replaces destination wallet addresses with attacker-controlled accounts before transaction signing.

Aikido Security researcher Charlie Eriksen explained:

The Crypto Investor Blueprint: A 5-Day Course On Bagholding, Insider Front-Runs, and Missing Alpha

Nice Your first lesson is on the way.

Please add [email protected] to your email whitelist.

“What makes it dangerous is that it operates at multiple layers: altering content shown on websites, tampering with API calls, and manipulating what users’ apps believe they are signing.”

Ledger CTO Charles Guillemet warned crypto users about the ongoing threat, noting the JavaScript ecosystem may be compromised given the massive download figures.

Hardware wallet users retain protection if they verify transaction details before signing, while software wallet users face a higher risk. Guillemet advised:

“If you don’t use a hardware wallet, refrain from making any on-chain transactions for now.”

He also noted uncertainty about whether attackers can directly extract seed phrases from software wallets.

Sophisticated targeting

The attack represents a sophisticated supply chain targeting where criminals compromise trusted development infrastructure to reach end users.

By infiltrating packages downloaded billions of times weekly, attackers gained unprecedented access to cryptocurrency applications and wallet interfaces.

BleepingComputer identified the phishing infrastructure exfiltrating credentials to “websocket-api2.publicvm.com,” demonstrating the coordinated nature of the operation.

This incident follows similar JavaScript library compromises throughout 2025, including the July attack on “eslint-config-prettier,” which had 30 million weekly downloads, and March compromises affecting ten popular NPM libraries.

Mentioned in this article

Cointelegraph, one of the leading crypto media platforms, has confirmed a front-end security breach that exposed its users to a malicious pop-up urging them to connect their wallets.

The incident, which occurred on June 22, involved scammers promoting a fake Cointelegraph token (CTG) and a counterfeit initial coin offering (ICO) campaign.

Scam Sniffer, a blockchain security platform, first flagged the compromise, noting that the attackers aimed to deceive users into granting wallet access. Once connected, these wallets could be drained of assets.

Scam Sniffer traced the exploit to a JavaScript payload embedded via the site’s advertising infrastructure. The code appeared to come from a domain resembling AdButler, though it had been recently registered and linked to a malicious script hidden within a banner advertisement.

In a public statement, Cointelegraph acknowledged the issue and warned users not to interact with pop-ups promoting “CTG tokens” or “CoinTelegraph ICO airdrops.”

The platform emphasized that it is actively investigating and working to remove the malicious code. Users were advised not to enter personal details or connect wallets to any prompts on the site.

CoinMarketCap faced similar exploits

This incident follows a similar attack on CoinMarketCap just two days prior.

On June 20, the crypto data provider briefly experienced a front-end breach that resulted in a fake wallet prompt appearing on its homepage.

CoinMarketCap traced the vulnerability to a doodle image linked to unauthorized JavaScript, which briefly disrupted the site’s interface. It noted:

“Our security team identified a vulnerability related to a doodle image displayed on our homepage. This doodle image contained a link that triggered malicious code through an API call, resulting in an unexpected pop-up for some users when visited our homepage.”

While the message on each site differed, both cases followed a near-identical delivery mechanism: a deceptive pop-up disguised as a platform feature. This may indicate a coordinated campaign targeting high-traffic crypto websites using ad-based JavaScript exploits.

Security experts pointed out that the twin breaches highlight a growing trend of attackers exploiting trusted platforms to execute wallet-draining schemes. As a result, they urged crypto users to remain cautious, avoid interacting with unknown dApps, and regularly monitor wallet activity to stay safe.

Mentioned in this article

JPMorgan Chase, Bank of America and TD Bank are disclosing data breaches that are placing some customers’ accounts and personal information at risk.

In new filings with the Massachusetts state government, Chase says at least four customers in the state are affected by multiple breaches.

In two incidents, Chase says employees improperly accessed customers’ credit and debit card information and triggered fraudulent transactions, prompting the bank to close the affected cards, issue replacements, and reimburse the customers.

In the other two incidents, the bank says it mistakenly posted transaction details, including names, addresses, account numbers, and transaction amounts, to other customers’ accounts. At this point, no misuse due to those errors has been detected.

Meanwhile, Bank of America says documentation relating to at least one customer’s savings bonds was lost in transit on February 14th.

Attempts to recover the documentation, according to the North Carolina-based lender, have proved unsuccessful.

“According to our records, the information involved in this incident was related to your Savings Bonds and included your first and last name, address, Social Security number, and account number.”

The lender says it is monitoring the customer’s banking account for any suspicious activity and is committed to resolving any unauthorized transactions.

Lastly, TD Bank says a former employee improperly accessed a customer’s personal information between December of 2024 and January of 2025.

The information may have included the customer’s name, address, phone number, social security number, account number, and transactional data.

TD Bank says it’s monitoring the account for fraud and is offering the customer a complimentary two year membership to an identity theft protection and recovery service.

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney