This comes as a major shock to the crypto industry.
In a major coordinated attack on the web3 space, on-chain sleuths discovered a massive supply chain attack on Lottie Player earlier today. The LottieFiles team reported that attackers injected malicious code into several versions of Lottie Player, including 2.05, 2.06, and 2.0.7, which were published on GitHub’s npm platform.
“The unauthorized versions contained code that prompted for connecting to user’s crypto wallets. A large number of users using the library via third-party CDNs without a pinned version were automatically served the compromised version as the latest release,” the LottieFiles team noted.
The LottieFiles team is currently investigating the incident, suspecting that a developer with the necessary privileges facilitated the attack. They have since released a new secure version, called 2.0.8, which is a copy of the original Lottie Player version 2.0.4.
To prevent further harm, the LottieFiles team has unpublished the compromised package versions from the npm platform. They also removed all access and associated service accounts of the impacted developer.
According to the on-chain analysis platform Scam Sniffer, the Lottie Player supply chain attack affected major decentralized applications (DApps), including 1inch (1INCH) and Movement Network. The attackers aimed to drain users’ funds, prompting the 1inch protocol to pledge refunds to all affected users through its network.
In response to the attack, the 1inch team has urged all impacted users to revoke ERC20 smart contract approvals from malicious addresses using revoke.cash to avoid further losses. On-chain data analysis revealed that a web3 user lost 10 Bitcoins, worth over $720,000, earlier today due to the Lottie Player supply chain attack.
As the dust settles on this attack, one question remains: What’s next for the web3 world?
Ethereum is turning heads once again, and this time it is because the price has…
The US economy and the cryptocurrency market are closely connected. Therefore, for crypto traders, it…
Capital B, formerly known as The Blockchain Group, has confirmed the purchase of 58 Bitcoin…
Tokyo Beast, a cyberpunk blockchain RPG on Immutable zkEVM, will close on August 24th, just…
US spot Ethereum ETFs attracted $1.85 billion in inflows last week, dramatically surpassing the $72…
Billionaire investor Ray Dalio has advised allocating 15% of a portfolio to Bitcoin or gold…