Tag: Security & Hacks

Fake Uniswap Site Steals Crypto Funds

A fraudulent website masquerading as Uniswap is currently siphoning funds from multiple cryptocurrency wallets, according to on-chain analyst “b-block.” The analyst estimates that the scammers have already amassed at least $400,000 in stolen assets.

Users are advised to only use official links and to verify protocols through DefiLlama.

Rise in Malicious Google Ads

This warning follows a report from the security group SEAL, which detailed a significant increase in malicious Google Ads targeting cryptocurrency users. SEAL found that attackers were impersonating popular decentralized finance (DeFi) platforms, wallets, and trading applications to steal funds.

SEAL reported blocking over 356 malicious Google ad URLs linked to crypto scams. These ads targeted platforms including Uniswap, Morpho Finance, PancakeSwap, Hyperliquid, CoW Swap, and 1inch.

The attackers utilized compromised or fraudulently obtained Google advertiser accounts and employed cloaking, fingerprinting, and nested iframe delivery systems to circumvent Google’s automated review processes. Many of the fake ads leveraged trusted Google services like sites.google.com and docs.google.com to appear legitimate in search results.

SEAL identified crypto drainer families, including Inferno Drainer and Vanilla Drainer, as the primary malware used in these campaigns. These tools trick users into signing malicious wallet transactions or entering recovery seed phrases on cloned websites, enabling attackers to seize control of wallet assets.

SEAL also noted that the sophisticated infrastructure used in these attacks, including Cloudflare Workers, Arweave-hosted payloads, traffic redirection systems, and proxy layers, allows for the interception of Ethereum RPC requests and real-time monitoring of user activity.

Uniswap was the most impersonated platform, accounting for 41% of the malicious sites tracked. Between March 13 and March 30, confirmed and unattributed losses linked to these campaigns exceeded $1.27 million, though SEAL believes the actual figure is likely much higher.

Other Recent Phishing Campaigns

While the recent Uniswap-related scams primarily involved fake websites and malicious Google Ads, a separate phishing campaign earlier this year targeted Ledger users via fraudulent emails. This attack followed a data breach at Ledger’s third-party e-commerce partner, Global-e, which exposed customer contact and order information.

The scammers falsely claimed that Ledger and Trezor had merged and urged users to migrate their wallets through fake websites that requested 24-word recovery phrases. The phishing pages closely mimicked the companies’ official branding and messaging.

More recently, Ripple CTO David Schwartz warned of a phishing campaign that sent fake security alerts appearing to originate from Robinhood’s official email system. These emails passed authentication checks because attackers exploited Robinhood’s account creation process, making the messages appear legitimate.

The phishing emails claimed a new login from an “iPhone 17 Pro” and prompted users to review suspicious activity via a “Review Activity Now” button, which then led to credential theft. Robinhood later confirmed the issue, stating that no systems were breached and no funds were affected.

Coinbase spent roughly $7.6 million on personal security for CEO Brian Armstrong in 2025, a more than 20% increase from the previous year.

Spending Increase Follows Rise in Physical Attacks

This figure, according to the company’s proxy filings cited in a Bloomberg report, comes after a 75% increase in physical attacks on cryptocurrency holders last year. Data from blockchain security firm CertiK indicates 72 confirmed incidents and $41 million in known losses.

The $7.6 million spent by Coinbase exceeds the typical security spending disclosed by major Wall Street banks for their CEOs. In comparison, Gemini reportedly spent around $2.5 million on security for co-founders Cameron and Tyler Winklevoss in 2025 and has since contracted to protect the twins and their families for $400,000 per month.

Circle spent nearly $800,000 on CEO Jeremy Allaire in 2024, while Robinhood spent approximately $1.6 million on Vlad Tenev. The heightened focus on security is evident throughout the industry. For instance, at the Bitcoin 2026 conference in Las Vegas last month, prominent speakers were seen with personal bodyguards.

Security Concerns Drive Demand for Protection

A workshop led by Bitcoin security expert Ben Perrin, which taught attendees how to protect their digital assets under physical coercion, including the use of decoy wallets, time-lock mechanisms, and duress features on hardware wallets, was one of the most popular at the conference.

Similar security measures were in place at Paris Blockchain Week a few weeks earlier, where guests were escorted by a police motorcade to a VIP dinner, and organizers increased security around the event.

The threat is tangible, as illustrated by the case of Sillytuna, a crypto holder who reported in March that armed attackers stole around $24 million in tokens after physically intimidating him and threatening kidnapping and sexual assault.

The vulnerability of crypto owners stems from the technology itself. Public blockchains are pseudonymous, not anonymous, revealing ownership information to anyone with the appropriate analytical tools. As a result, leaked exchange data and chain analytics have created, in Bloomberg’s words, “a legible map of who holds what.”

Consequently, demand for protection services has surged. Executive Risk Services, a firm specializing in the digital-asset industry, has seen client inquiries increase from roughly once per quarter two years ago to about once a week now.

Amsterdam-based Infinite Risks International, which provides bodyguards, armored vehicles, and social media monitoring to crypto holders, has also experienced a rise in inquiries, long-term clients, and proactive requests, according to Managing Director Jethro Pijlman.

France has become a hotspot for crypto crime following a series of attacks on crypto entrepreneurs and their families. Last year, the country’s Interior Minister pledged to establish a priority emergency number for the industry, with elite police units offering security briefings for crypto executives and their families.

Based Apparel Website Goes Offline Amid Malware Concerns

An apparel store with ties to FBI Director Kash Patel reportedly went offline on Friday following warnings that its website was distributing wallet-draining malware.

Malware Warning

Before the website’s apparent shutdown, visitors using macOS were prompted to install “ClickFix” malware. This involved copying and pasting a command into their system’s terminal, which exposed session tokens, browser data, and cryptocurrency wallets to an infostealer, according to a user on X.

The website was flagged as “potentially deceptive” for users of MetaMask, a self-custodial wallet. When attempting to visit the site, MetaMask users received a warning about potential risks, including “malicious transactions resulting in stolen assets.”

PCMag was able to reproduce the attack. However, Decrypt was unable to do so, as Based Apparel now states that “the store will be back online shortly—bolder than ever.”

Infostealer malware is designed to secretly extract sensitive data from users’ devices. Such malware has been around since at least 2006. Two months ago, the FBI announced it was investigating several PC games on the Steam platform that installed the malicious software.

Website Traffic and Ownership

It remains unclear whether the apparent compromise of Based Apparel resulted in significant losses. According to Ahrefs, the website typically receives an estimated 33,600 visits monthly. One of its top pages features a camouflage hoodie.

The venture is owned by Patel and Andrew Ollis, who serves as CEO on the board of the Kash Foundation, according to The Guardian. Visitors to the Kash Foundation are directed to Based Apparel through one of the nonprofit’s primary menus.

Patel’s Affiliations

While Patel founded the nonprofit, he is no longer affiliated with it in any capacity, according to the organization’s website. A disclosure also clarifies that the Kash Foundation is not associated with government agencies, including the FBI.

The FBI director, who has emphasized the bureau’s increasing use of artificial intelligence to combat malicious actors, has previously been targeted by cryptocurrency-related schemes. Following the leak of his personal email and burner username by Iranian hackers, a series of Patel-themed meme coins emerged.

On-chain investigator ZachXBT flagged a suspected drain tied to Polymarket on Friday, reporting that over $520,000 had been taken from addresses linked to the prediction market’s Polygon infrastructure.

Polymarket Acknowledges Breach

Polymarket developers later acknowledged the incident, stating that it involved an internal rewards wallet and did not affect user funds or market outcomes.

“Findings point to a private key compromise of a wallet used for internal top-up operations, not contracts or core infrastructure,” the Polymarket Developers account tweeted.

Over an hour after the initial disclosure, the on-chain analytics platform Bubblemaps estimated the loss at approximately $700,000. Bubblemaps indicated that the funds were split across 16 addresses and routed through centralized exchanges and other services.

Prediction markets on Polymarket utilize contracts that record bets and pay winners after an external service confirms the result. The wallet involved in Friday’s incident appears to have been used for rewards payments, separate from the contracts that handle user funds and market outcomes.

Experts Weigh In

Andy Yajin Zhou, associate professor at the Chinese University of Hong Kong and co-founder of on-chain security firm BlockSec, told Decrypt that their initial review aligned with the Polymarket developers’ account, suggesting a private key compromise rather than a flaw in the platform’s core systems.

“Based on our initial analysis, this does not appear to be a flaw in the adapter contract logic or prediction market infrastructure itself,” Zhou said. “At this stage, we have not identified evidence suggesting a protocol-level exploit, oracle manipulation, or a generalized vulnerability in adapter-based market infrastructure.”

Zhou explained that incidents like this highlight operational security risks, including key management, access control, signing policies, monitoring, and other safeguards surrounding wallets used for routine operations.

Blockchain security firm Cyvers reached a similar conclusion, stating that the incident appeared to affect operational or admin wallets instead of Polymarket’s core contracts or its system used for settling markets, pointing to a broader industry risk around privileged wallets.

“Even when prediction market protocols are secure at the smart contract level, privileged adapter or admin wallets remain a critical attack surface if key management or operational security is compromised,” Hakan Unal, senior security operation lead at Cyvers, told Decrypt.

Dan Dadybayo, strategy lead at crypto infrastructure developer Horizontal Systems, told Decrypt that the incident fits a broader shift in how attackers are targeting crypto projects.

“This increasingly looks like a key management failure rather than a smart contract exploit,” Dadybayo said. “The interesting shift across crypto is that attackers are no longer primarily breaking protocols. They’re targeting the operational layers around them: admin wallets, permissions, and infrastructure.”

Decrypt has reached out to Polymarket for comment and will update this article should they respond. This is a developing story.

Malware Campaign Targets Software Supply Chains

A malware campaign dubbed “Shai-Hulud” is spreading through the software pipelines used by developers to build and distribute code, raising concerns about the reliance on automated systems with minimal human oversight.

Researchers have linked the Shai-Hulud malware campaign to approximately 320 package entries across Node Package Manager (NPM) and PyPI, two major online repositories used by developers to download and share JavaScript and Python software packages. These affected packages collectively account for over 518 million monthly downloads.

“Shai-Hulud is significant because it exposes a problem we cannot fully patch away: modern software is built by running other people’s code,” said Jeff Williams, CTO of the California-based security firm Contrast Security. “Developers do not merely ‘download’ libraries. They install them, build with them, test with them, deploy with them, and eventually execute them. And if you run a malicious library, it can do almost anything you can do.”

Williams added that advances in artificial intelligence complicate the threat, comparing Shai-Hulud to making a computer a double-agent.

“The scary part is the leverage. If an attacker compromises one obscure package, they do not just get that package,” Williams said. “They get a path into every downstream project that trusts it. Then they can steal more tokens, publish more poisoned packages, and repeat the cycle. The software supply chain is not a chain anymore—it’s a propagation network.”

Recent Incidents and Impact

Earlier this month, Microsoft Threat Intelligence disclosed that attackers inserted malicious code into a Mistral AI software package distributed through PyPI. The malware downloaded an additional file designed to resemble Hugging Face’s widely used Transformers library to blend into machine-learning development environments. Mistral later stated that an affected developer device was involved but that there was “no indication that Mistral infrastructure was compromised.”

Two days later, OpenAI confirmed that malware tied to the same campaign infected two employee devices, giving attackers access to a limited number of internal code repositories. The company found no evidence that customer data, production systems, or intellectual property were compromised.

Named after the giant sandworms in Frank Herbert’s “Dune,” researchers traced earlier versions of the malware back to September 2023 and cybercriminals known as TeamPCP. However, the campaign gained wider attention after a major May 11 attack targeting TanStack, a widely used open-source JavaScript framework used in web and cloud applications.

Growing Threat to Software Supply Chains

Shai-Hulud is part of a growing trend of supply-chain attacks where hackers compromise trusted software tools or services used by other companies. Instead of directly targeting victims, attackers use these trusted systems to spread malicious code or gain access to developer environments.

Researchers say the attacks poison shared build caches, causing future software releases to quietly incorporate the malicious code. To a developer downloading the packages, everything appears normal because the software comes from trusted sources, carries valid signatures, and passes security checks. This is what makes the attack so concerning.

On Sunday, cybersecurity firm OX Security reported that new malicious packages mimicking the original malware were already stealing cloud and crypto wallet credentials, SSH keys, and environment variables. Some variants also attempted to turn infected machines into DDoS botnets.

“One incriminating evidence that this is a different actor from TeamPCP is that the Shai-Hulud malware code is an almost exact copy of the leaked source code, with no obfuscation techniques, which make the final version visually different from the original,” OX Security wrote. “In our breakdown, we show the side by side comparison of the chalk-template Shai-Hulud version with the original source code leak, showing that they are the same.”

Broader Implications

The emergence of Shai-Hulud coincides with the increasing reliance of modern software developers on automated platforms like GitHub Actions. Simultaneously, supply-chain attacks targeting open-source infrastructure have become more common as attackers focus on developer tooling and automated publishing systems rather than end-user systems directly.

“[Shai-Hulud] is a reminder that [systems, applications, and products] attack surface now extends well beyond traditional application layers and into the open-source packages that power modern development and deployment workflows,” said Joris Van De Vis, Director of Security Research at the Netherlands-based cybersecurity firm SecurityBridge.

On Tuesday, GitHub announced it was investigating unauthorized access to its internal repositories after TeamPCP claimed responsibility for stealing roughly 4,000 private repos and offering the data for sale on a cybercrime forum for at least $50,000.

According to Van De Vis, Shai-Hulud also demonstrates how attacks targeting trusted software automation can quickly spread from developer tools into enterprise systems that companies rely on for critical operations.

“When trusted npm dependencies can be weaponized to steal credentials from [Cloud Application Programming] and [Multi-Target Application] environments, the risk is no longer just a developer laptop issue, it becomes a direct path toward productive SAP systems, which is why organizations need tighter dependency controls, exact version pinning, and stronger publishing safeguards,” Van De Vis said.

GitHub Repositories Breached, Prompting Security Concerns

Hackers gained access to GitHub’s internal repositories earlier today by exploiting an employee’s computer through a compromised VS Code extension.

Following the incident, reports surfaced that a threat actor using the alias TeamPCP is allegedly selling approximately 4,000 of GitHub’s private repositories on a cybercriminal forum, with a minimum asking price of $50,000.

GitHub confirmed the breach via posts on its X account, detailing the information available at the time. According to the platform, the attacker gained access to its internal repository through a malicious VS Code extension loaded onto an employee’s device.

GitHub stated that it promptly removed the malicious software from the infected machine upon discovering the attack. Crucially, the company emphasized that there is currently no evidence that customer data held outside its internal systems, including individual users’ enterprises, organizations, or repositories, was accessed.

The hosting service also confirmed it quickly rotated credentials, prioritizing the most critical secrets. It will also examine logs to identify any additional activity and will provide further details after the investigation concludes.

Alleged Sale of Stolen Data

Meanwhile, French researcher Sébastien Latombe highlighted a listing on a criminal message board by the threat actor TeamPCP, claiming responsibility for the hack. The listing mentions repositories related to GitHub Actions, GitHub Enterprise, GitHub Copilot, Azure, CodeQL, billing, and authentication services.

TeamPCP is reportedly seeking a single buyer for the stolen data, rather than a ransom from GitHub, with a minimum asking price of $50,000.

However, neither GitHub nor Microsoft has officially confirmed the content of the forum listing. Claims made on cybercriminal sites should be treated with caution, as the data provided may be outdated or exaggerated to inflate its perceived value.

Industry Response and Broader Security Concerns

The online reaction to the breach was swift. Binance co-founder Changpeng Zhao (CZ) urged crypto developers to review and change their API keys if they are present in their code, even in private repositories.

Responses highlighted a widespread industry problem. Topaz DEX founder Aaron Shames called it “bad practice to have API keys in any repo, private or not,” while acknowledging the warning.

Others pointed out that managing hundreds of keys across projects is not a simple task for developers.

Digital artist Tuteth_ wrote, “This entire practice of key storage needs an update.”

Security commentator Dhanush Nehru added, “No one knows what all permissions each VS Code extension owns. The cybersecurity threat landscape is scary.”

The timing of this incident has heightened existing concerns about crypto security, following multiple high-profile hacks this month, including an attack on Echo Protocol, where hackers minted $76.7 million worth of eBTC.

That incident followed multimillion-dollar attacks on THORChain and the Verus-Ethereum Bridge.

These events have reignited discussions about code verification and software supply chain vulnerabilities, with Vitalik Buterin suggesting that formal verification, aided by AI, can enhance software security by mathematically proving its behavior.

Verus-Ethereum Bridge Exploited for $11.58 Million

Hackers have reportedly stolen $11.58 million from the Verus-Ethereum bridge, according to alerts from blockchain security platforms. The exploit targeted one of Verus’s cross-chain bridge contracts, resulting in the draining of reserves containing ETH, tBTC, and USDC.

Suspicious Activity Detected

Security firms CertiK and PeckShield flagged suspicious activity from the bridge contract at 0x71518580…cd7f63 within hours of the exploit. Their posts on X indicated that the stolen assets included 1,625 ETH, 103.56 tBTC, and 147,000 USDC. The attacker quickly converted the assets into approximately 5,402 ETH and transferred the funds to a separate wallet.

Technical Breakdown of the Exploit

Blockaid, another on-chain security firm, published a technical analysis of the incident. According to their report, the bridge correctly verified a notarized Verus state root, a Merkle proof of the cross-chain export, and a hash binding confirming the integrity of the transfer data. However, the bridge failed to validate whether the source-chain export’s stated amounts matched the payout.

The attacker constructed a transaction on the Verus side for approximately 0.02 VRSC, worth about $0.01, which committed a keccak hash of a payout blob while listing empty source-side totals. The Verus protocol accepted the transaction, and the notaries signed the resulting state root without issue.

On the Ethereum side, the attacker used submitImports() with a serialized transfer blob whose hash matched the committed value. The bridge then verified the hash, decoded the blob, and disbursed 1,625 ETH, 103 tBTC, and 147,000 USDC from its reserves to the attacker.

In essence, the attacker spent about $10 in VRSC fees and received $11.58 million in return. The Blockaid report noted that there was no ECDSA bypass, no compromise of notary keys, and no parser or hash-binding bug. The vulnerability stemmed from a missing source-amount validation in the “checkCCEValues” function, which, according to the security firm, could be fixed with around ten lines of Solidity code.

Broader Impact on the Crypto Sector

Certik reported that the wider crypto sector lost over $650 million to malicious actors last month, with a significant portion of that amount resulting from two incidents: an attack on KelpDAO, which led to the theft of more than $292 million, and another on Drift Protocol, which lost over $285 million.

Bridges are increasingly targeted, with the Verus exploit being the eighth incident involving such platforms this year. PeckShield estimates that attackers have stolen at least $328 million from these platforms.

Market Reaction

VRSC, the Verus native token, did not appear to react significantly to the news of the exploit. Data from CoinGecko indicates that the token remained largely flat on the day of the hack, with minimal movement in the 24-hour period leading up to the attack. At the time of writing, VRSC was trading at approximately $0.75, down 6% over 30 days, and had lost nearly 73% of its value in the past year.

Ethereum’s price is struggling, barely holding above $2,100, as a new protocol risk fuels bearish sentiment. A cross-chain bridge exploit has just resulted in the loss of over $11 million, occurring at a particularly sensitive moment for the cryptocurrency.

Verus-Ethereum Bridge Hacked

PeckShieldAlert reported that the Verus-Ethereum Bridge was exploited, resulting in the theft of 103.6 tBTC, 1,625 ETH, and 147,000 USDC. The attacker has already converted the stolen funds into 5,402 ETH, which are now held in a single wallet.

The Verus-Ethereum bridge was the target of the attack. The perpetrator extracted the assets before swapping them for 5,402.4 ETH, valued at just over $11 million. This exploit follows a pattern of significant losses: Kelp DAO lost $293 million in April through LayerZero’s cross-chain messaging system, and the Drift attack earlier this year added $270 million to the industry’s losses.

These bridge exploits consistently account for the largest individual losses each year. Oracle and protocol vulnerabilities also pose a systemic threat.

Market Analysis and Outlook

ETH is currently experiencing a bearish-to-neutral consolidation phase, with limited catalysts to reverse the trend. The current price is $2,110, and the Relative Strength Index (RSI) is at 34, indicating weak overall momentum.

Key levels are defining the near-term range. Support is at $2,100; a close below this level could lead to further declines. Resistance is clustered at $2,200, with $2,250 as the next level if ETH breaks out.

On-chain liquidity and the structure of the DeFi market suggest that the exploit will hinder any recovery. A shift away from smaller DeFi tokens is already evident. ETH needs a catalyst to initiate a rebound.

The Future of Cross-Chain Infrastructure

ETH’s consolidation near six-week lows, coupled with ongoing cross-chain infrastructure exploits, raises concerns for DeFi participants: what would a safer, unified liquidity architecture look like?

The current fragmentation of assets across Bitcoin, Ethereum, and Solana creates high-value targets for attacks on bridges. The $293 million loss by Kelp DAO was due to a LayerZero messaging failure, not a smart contract bug.

LiquidChain, a Layer 3 infrastructure project, is developing what it calls the Cross-Chain Liquidity Layer, aiming to merge BTC, ETH, and SOL liquidity into a single execution environment. The architecture is based on four components: a Unified Liquidity Layer, Single-Step Execution, Verifiable Settlement, and a Deploy-Once model that allows developers to access all three ecosystems without redeploying across chains.

The presale token, $LIQUID, is currently priced at $0.0146, with $770,000 raised to date. The project is also offering a 1500% APY staking bonus for early buyers.