Malicious 'contractshark.solidity-lang' Cursor extension steals an Ethereum core developer's private key
Cursor AI code editor users
Cointelegraph reported on 13 August 2025 that an Ethereum core developer's hot wallet was drained after he installed 'contractshark.solidity-lang', a fake Solidity extension for the Cursor AI code editor with over 54,000 downloads. The extension read his .env file and sent the private key to the attacker, who waited three days before emptying the wallet. The loss was a few hundred dollars because he kept only test funds there and his main holdings on hardware wallets. Keep keys out of .env files on development machines and use small, separate test wallets.
Why this severity: 1 victims, only partly contained.
AI involvement
AI agents as the target. The key-stealing extension was installed in Cursor, the AI code editor the developer used as a coding assistant; it read the .env file rather than abusing the AI itself.
Give agents a small, capped wallet with allow-listed destinations, and never let an agent that can sign read untrusted content.
- Started
- Aug 13, 2025
- Closed
- Aug 13, 2025
- Chains
- Ethereum
- Method
- Supply-chain stealers
- Victims
- 1
At risk
- Cursor AI code editor users
- Ethereum wallets
What to do now
- Remove the extension and move funds from every wallet whose key was in a .env or config file on that machine.
- Rotate API keys and tokens stored in those files.
Stay safe
Am I affected?
You may be affected if you installed 'contractshark.solidity-lang' or another unofficial Solidity extension in Cursor or a VS Code-based editor, and your project folders hold .env files with private keys.
What to do now
- Remove the extension and move funds from every wallet whose key was in a .env or config file on that machine.
- Rotate API keys and tokens stored in those files.
How to avoid this
- Keep only small test funds in development wallets, one per project, and hold real funds on hardware wallets.
- Don't keep private keys in plain-text .env files; use a hardware signer or a secrets manager.
- Install editor extensions only from verified publishers and check the exact extension ID, not just the name.
Timeline 1
Cointelegraph reported that a malicious Cursor extension had taken an Ethereum core developer's private key and the hot wallet was drained the previous Sunday.
Source
News & write-ups ›1
How this method works
A popular code package or app update is hijacked to steal wallet keys or swap addresses, hitting everyone who installs it. Read about supply-chain stealers →
Follow new drains and updates in your feed reader or Telegram RSS bot.