News View Non-AMP

Lottie Player Crypto Hack: Major DApps Attacked, Users Lose $720K

Published by
Qadir AK

This comes as a major shock to the crypto industry.

In a major coordinated attack on the web3 space, on-chain sleuths discovered a massive supply chain attack on Lottie Player earlier today. The LottieFiles team reported that attackers injected malicious code into several versions of Lottie Player, including 2.05, 2.06, and 2.0.7, which were published on GitHub’s npm platform.

“The unauthorized versions contained code that prompted for connecting to user’s crypto wallets. A large number of users using the library via third-party CDNs without a pinned version were automatically served the compromised version as the latest release,” the LottieFiles team noted

Users at Risk? Here’s What Was Done

The LottieFiles team is currently investigating the incident, suspecting that a developer with the necessary privileges facilitated the attack. They have since released a new secure version, called 2.0.8, which is a copy of the original Lottie Player version 2.0.4.

To prevent further harm, the LottieFiles team has unpublished the compromised package versions from the npm platform. They also removed all access and associated service accounts of the impacted developer.

Impact of the Lottie Player Supply Chain Attack

According to the on-chain analysis platform Scam Sniffer, the Lottie Player supply chain attack affected major decentralized applications (DApps), including 1inch (1INCH) and Movement Network. The attackers aimed to drain users’ funds, prompting the 1inch protocol to pledge refunds to all affected users through its network.

In response to the attack, the 1inch team has urged all impacted users to revoke ERC20 smart contract approvals from malicious addresses using revoke.cash to avoid further losses. On-chain data analysis revealed that a web3 user lost 10 Bitcoins, worth over $720,000, earlier today due to the Lottie Player supply chain attack.

As the dust settles on this attack, one question remains: What’s next for the web3 world?

Qadir AK

Qadir Ak is the founder of Coinpedia. He has over a decade of experience writing about technology and has been covering the blockchain and cryptocurrency space since 2010. He has also interviewed a few prominent experts within the cryptocurrency space.

Recent Posts

XRP Price Prediction As Ripple Applies for U.S. National Bank License

Ripple has officially applied for a national banking license in the United States. If approved,…

July 3, 2025

Is Bitcoin Price Poised for a Historical Rally in July Fueled By Institutional Investors?

After closing June in the highest monthly close since inception, Bitcoin (BTC) price has signaled…

July 3, 2025

Donald Trump Net Worth Gets a Crypto Boost, $620M in Just Months!

US President Donald Trump’s name has long been tied to big hotels, golf resorts, and…

July 3, 2025

US Housing Chief Hits Fed Chair Powell with $2.5B Misused — Here’s Why

A new fight is heating up in Washington. US Federal Housing Finance Agency, William J.…

July 2, 2025

Ripple Eyes U.S. Banking License Amid Regulatory Push

Ripple Labs, a blockchain-based cross-border company, has filed for a national banking license with the…

July 2, 2025

GameFi Shaken—New AI Token Raises $502k in 24 Hours

Block3 just started one of the fastest-growing crypto presales in GameFi history. It’s raised over…

July 2, 2025