News View Non-AMP

Lottie Player Crypto Hack: Major DApps Attacked, Users Lose $720K

Published by
Qadir AK

This comes as a major shock to the crypto industry.

In a major coordinated attack on the web3 space, on-chain sleuths discovered a massive supply chain attack on Lottie Player earlier today. The LottieFiles team reported that attackers injected malicious code into several versions of Lottie Player, including 2.05, 2.06, and 2.0.7, which were published on GitHub’s npm platform.

“The unauthorized versions contained code that prompted for connecting to user’s crypto wallets. A large number of users using the library via third-party CDNs without a pinned version were automatically served the compromised version as the latest release,” the LottieFiles team noted

Users at Risk? Here’s What Was Done

The LottieFiles team is currently investigating the incident, suspecting that a developer with the necessary privileges facilitated the attack. They have since released a new secure version, called 2.0.8, which is a copy of the original Lottie Player version 2.0.4.

To prevent further harm, the LottieFiles team has unpublished the compromised package versions from the npm platform. They also removed all access and associated service accounts of the impacted developer.

Impact of the Lottie Player Supply Chain Attack

According to the on-chain analysis platform Scam Sniffer, the Lottie Player supply chain attack affected major decentralized applications (DApps), including 1inch (1INCH) and Movement Network. The attackers aimed to drain users’ funds, prompting the 1inch protocol to pledge refunds to all affected users through its network.

In response to the attack, the 1inch team has urged all impacted users to revoke ERC20 smart contract approvals from malicious addresses using revoke.cash to avoid further losses. On-chain data analysis revealed that a web3 user lost 10 Bitcoins, worth over $720,000, earlier today due to the Lottie Player supply chain attack.

As the dust settles on this attack, one question remains: What’s next for the web3 world?

Qadir AK

Qadir Ak is the founder of Coinpedia. He has over a decade of experience writing about technology and has been covering the blockchain and cryptocurrency space since 2010. He has also interviewed a few prominent experts within the cryptocurrency space.

Recent Posts

Ethereum Price Eyes $4 – Liquidation Risks Loom

Ethereum is turning heads once again, and this time it is because the price has…

July 28, 2025

Key US Economic Events This Week: What They Mean for Bitcoin and Altcoins

The US economy and the cryptocurrency market are closely connected. Therefore, for crypto traders, it…

July 28, 2025

French Firm Capital B Adds 58 Bitcoin to Its Treasury

Capital B, formerly known as The Blockchain Group, has confirmed the purchase of 58 Bitcoin…

July 28, 2025

Tokyo Beast: Cyberpunk Blockchain RPG to Shut Down in August

Tokyo Beast, a cyberpunk blockchain RPG on Immutable zkEVM, will close on August 24th, just…

July 28, 2025

US Spot Ethereum ETFs Outpace Bitcoin With $1.8B Weekly Inflows

US spot Ethereum ETFs attracted $1.85 billion in inflows last week, dramatically surpassing the $72…

July 28, 2025

Ray Dalio Recommends 15% Portfolio Allocation to Bitcoin or Gold

Billionaire investor Ray Dalio has advised allocating 15% of a portfolio to Bitcoin or gold…

July 28, 2025