Evil Actor Targets Atomic and Exodus Wallet Users
- Cybercriminals are employing a new attack vector, targeting users of Atomic and Exodus wallets through compromised open-source software repositories.
- ReversingLabs, a cybersecurity firm, reported a campaign where attackers compromised the Node Package manager (NPM) library.
- First, the malware scans the infected device for cryptocurrency wallets.
Crypto Wallet Users Targeted in Open-source Software Attack
Table of Contents
- Crypto Wallet Users Targeted in Open-source Software Attack
- Crypto Wallet Security: Protecting Your Digital Assets
- what’s the Latest Threat to Crypto Wallet Users?
- What Are Open-Source Software Repositories, and Why Are They Vulnerable?
- How Do These Attacks Work?
- What is a Clipboard hijacker and How Does it Steal Crypto?
- Which Crypto Wallets Are Specifically Targeted?
- What Are the Long-Term Security Risks?
- How Can I Tell if My Crypto Wallet Has Been Compromised?
- How can I Remove This Malware From My System?
- Where Do I Get Trustworthy software??
- What Are Software Supply Chain Attacks?
- What Do Security Experts Say About These Attacks?
- Are Other Platforms Being Targeted?
- What Happens When An Account or Wallet Is Breached?
- What measures Can I Take to Protect My Crypto Wallet?
- What are some Best Security Practices?
- How Much Cryptocurrency Has Been Lost Due to These Types of Attacks?
- Key Takeaways About Crypto Wallet Security
- Is This a Growing Problem?
Cybercriminals are employing a new attack vector, targeting users of Atomic and Exodus wallets through compromised open-source software repositories. These attacks involve distributing malware-infiltrated packages designed to compromise private keys and steal digital assets.
How the Attacks Work
ReversingLabs, a cybersecurity firm, reported a campaign where attackers compromised the Node Package manager (NPM) library. The malicious packages often masquerade as legitimate tools, such as PDF converters, but contain hidden malware. Once installed,the malware executes a multi-pronged attack.
First, the malware scans the infected device for cryptocurrency wallets. It then injects malicious code into the system, including a clipboard hijacker.This hijacker secretly alters wallet addresses during transactions, redirecting funds to attacker-controlled wallets.
The malware also collects system details and monitors the success of its infiltration attempts. This data allows attackers to refine their methods and improve future attacks.
ReversingLabs noted the malware’s persistence. Even if the deceptive package, such as the fake PDF converter, is deleted, remnants of the malicious code remain active.
To fully clean an infected system, users must uninstall the affected cryptocurrency wallet software and reinstall it from a verified source.
Security experts emphasize that this threat underscores the growing risk of software supply chain attacks.
“The frequency and sophistication of software supply chain attacks targeting the cryptocurrency industry serve as a warning for other sectors. Organizations need to improve their ability to monitor threats and attack chains,” ReversingLabs stated.
Separately, Kaspersky researchers reported similar campaigns using Sourceforge, where cybercriminals upload fake Microsoft Office installations containing malware. These infected files include clipboard hijackers and crypto miners, disguised as legitimate software but operating covertly to compromise wallets.
These incidents highlight the increasing abuse of open-source platforms and a trend where attackers are hiding malware within trusted software packages.
Given the prevalence of these attacks, cryptocurrency users and developers should exercise vigilance, verify software sources, and implement robust security practices to mitigate these growing threats.
Defillama estimates that more than $1.5 billion in cryptocurrency assets were lost due to exploits in the first quarter of 2025. A Febuary breach of Bybit accounted for $1.4 billion of those losses.
Crypto Wallet Security: Protecting Your Digital Assets
This article explores the evolving threats to cryptocurrency users,specifically focusing on attacks targeting Atomic and Exodus wallets through compromised open-source software. We’ll break down the risks in a Q&A format to help you understand and protect your digital assets.
what’s the Latest Threat to Crypto Wallet Users?
Cybercriminals are increasingly targeting cryptocurrency users, focusing on wallets like Atomic and Exodus. The primary attack vector involves injecting malware through compromised open-source software repositories.
What Are Open-Source Software Repositories, and Why Are They Vulnerable?
Open-source repositories are essentially online libraries where developers share code and software packages. They’re seen as a good way to build software quickly and efficiently. However, this openness can also be a weakness. Attackers are exploiting this by injecting malicious code into these repositories, tricking users when they download the software.
How Do These Attacks Work?
The attacks involve the distribution of malware-infiltrated packages. Here’s a breakdown of how they work:
Compromise: Attackers compromise repositories like the node Package Manager (NPM) and Sourceforge.
Disguise: They insert malicious code into packages that appear legitimate, such as PDF converters or fake microsoft Office installations.
Infiltration: when users download and install these packages, the malware gains access to the system.
Attacks: The malware then launches a multi-pronged attack to steal digital assets, including:
Scanning for installed cryptocurrency wallets.
Injecting malicious code,including clipboard hijackers.
Collecting system details to refine future attacks.
What is a Clipboard hijacker and How Does it Steal Crypto?
A clipboard hijacker is a type of malware. It monitors the data you copy and paste. During cryptocurrency transactions,this malware will scan the copied wallet address and replace it with an address controlled by the attackers. This way, your funds are redirected to the attackers’ wallets without your knowledge.
Which Crypto Wallets Are Specifically Targeted?
According to the article, the attacks specifically target users of Atomic and Exodus wallets.
What Are the Long-Term Security Risks?
The malware, onc installed, is persistent. Even if the malicious package is deleted,remnants of the code remain active. This means the system is still vulnerable until the source is removed.
How Can I Tell if My Crypto Wallet Has Been Compromised?
Signs of compromise can be subtle, but here are some things to watch for:
Unusual Activity: Unexpected transaction amounts or transactions you did not authorize.
System Slowdowns: Performance issues or strange behavior on your device.
Suspicious Software: Programs you don’t remember installing.
How can I Remove This Malware From My System?
Removing the malware requires a multi-step approach:
- Uninstall: Uninstall the affected cryptocurrency wallet software (Atomic or Exodus, depending on which you use).
- Reinstall: Reinstall the wallet software from a verified and trustworthy source (the official website).
Where Do I Get Trustworthy software??
Always download software from the official source websites of the software developer.Be wary of software links from other locations as malicious downloads disguise themselves in these spaces.
What Are Software Supply Chain Attacks?
Software supply chain attacks are a type of cyberattack that targets the process of building and distributing software. Attackers compromise the components or processes used to create software, such as open-source libraries, growth tools, or update mechanisms. This allows them to inject malicious code into legitimate software and distribute it to unsuspecting users.
What Do Security Experts Say About These Attacks?
Security experts at ReversingLabs emphasize that these attacks highlight the growing risk of software supply chain attacks. They warn that organizations and users need to improve their ability to monitor threats to prevent similar attacks.
Are Other Platforms Being Targeted?
Yes. Aside from NPM, researchers have reported similar campaigns using platforms like SourceForge. These attacks exploit fake software updates and installations.
What Happens When An Account or Wallet Is Breached?
The user loses all of the assets in their crypto wallet or account.
What measures Can I Take to Protect My Crypto Wallet?
Verify software Sources: Always download software from official, verified sources.
Be Vigilant: Stay informed about security threats and best practices.
Implement Robust Security Practices: Use strong passwords, enable two-factor authentication (2FA), and keep your software and operating systems updated.
Monitor Transactions: Regularly review your transaction history for any suspicious activity.
Practice Safe Browsing: Be careful when clicking links in emails or on websites.
What are some Best Security Practices?
Here’s a summary of the most helpful steps you can take, broken down into easy-to-follow steps:
Secure Passwords: Create complex, unique passwords for each account. Aim for a combination of uppercase and lowercase letters,numbers,and symbols. Store passwords securely in a password manager.
Two-Factor Authentication (2FA): Enable 2FA whenever possible.This adds an extra layer of security by requiring a verification code from your phone or another device.
Software Updates: Keep your operating system, web browsers, and applications (including your crypto wallet software) updated to the latest versions.
Verify Website Security: Before entering any sensitive information, such as your password, verify that the website has HTTPS enabled in the address bar.
Educate Yourself: Stay informed about the latest phishing attempts and social engineering tactics used by cybercriminals. Be wary of unsolicited emails and messages asking for personal information.
Regular Backups: Back up your critically important files regularly, including your wallet seed (if you are able to back it up). Make a habit of it.
Use a Hardware Wallet (Recommended): Hardware wallets store your private keys offline.
How Much Cryptocurrency Has Been Lost Due to These Types of Attacks?
Defillama estimates that over $1.5 billion in cryptocurrency assets were lost due to exploits in the first quarter of 2025.A single breach of Bybit accounted for $1.4 billion of that loss.
Key Takeaways About Crypto Wallet Security
Here’s a simplified summary presented in a table for quickly grasping the main points:
| Threat | How it effectively works | Impact | protection |
|---|---|---|---|
| Compromised Open-Source Software | Malware injected into seemingly legitimate packages (e.g.,PDF converters). | Theft of private keys; Redirect of funds. |
Verify software sources; Uninstall and reinstall wallet from a trusted source; implement strong security practices. |
| Clipboard Hijackers | Clipboard hijacker that monitors wallet addresses, replacing it with the hijackers. |
Theft of funds | Monitor transactions for suspicious activity. |
Is This a Growing Problem?
Yes. The increasing frequency and sophistication of these types of attacks indicate a growing trend. Cryptocurrency users need to be proactive in their security measures.