{
 "slug": "cursor-contractshark-solidity-extension-dev-key-theft-aug-2025",
 "title": "Malicious 'contractshark.solidity-lang' Cursor extension steals an Ethereum core developer's private key",
 "url": "https://drains.watch/i/cursor-contractshark-solidity-extension-dev-key-theft-aug-2025",
 "json": "https://drains.watch/i/cursor-contractshark-solidity-extension-dev-key-theft-aug-2025.json",
 "status": "closed",
 "severity": "medium",
 "threatStatus": "partly-contained",
 "verification": "verified",
 "ai": {
  "role": "agent-target",
  "note": "The key-stealing extension was installed in Cursor, the AI code editor the developer used as a coding assistant; it read the .env file rather than abusing the AI itself."
 },
 "chains": [
  "ethereum"
 ],
 "method": "supply-chain",
 "product": "Cursor AI code editor users",
 "tags": [
  "ethereum",
  "supply-chain",
  "cursor",
  "ai-code-editor",
  "malicious-extension",
  "solidity",
  "env-file",
  "private-key",
  "developers",
  "ai"
 ],
 "amountUsd": null,
 "victims": 1,
 "startedAt": "2025-08-13",
 "closedAt": "2025-08-13",
 "updatedAt": "2025-08-13T12:00:00Z",
 "summary": "Cointelegraph reported on 13 August 2025 that an Ethereum core developer's hot wallet was drained after he installed 'contractshark.solidity-lang', a fake Solidity extension for the Cursor AI code editor with over 54,000 downloads. The extension read his .env file and sent the private key to the attacker, who waited three days before emptying the wallet. The loss was a few hundred dollars because he kept only test funds there and his main holdings on hardware wallets. Keep keys out of .env files on development machines and use small, separate test wallets.",
 "timeline": [
  {
   "date": "2025-08-13",
   "title": "Cointelegraph reported that a malicious Cursor extension had taken an Ethereum core developer's private key and the hot wallet was drained the previous Sunday.",
   "sourceUrl": "https://cointelegraph.com/news/core-ethereum-devs-crypto-wallet-drained-ai-extension"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Ethereum core dev's crypto wallet drained by malicious AI extension",
   "url": "https://cointelegraph.com/news/core-ethereum-devs-crypto-wallet-drained-ai-extension",
   "publisher": "Cointelegraph",
   "date": "2025-08-13"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nYou may be affected if you installed 'contractshark.solidity-lang' or another unofficial Solidity extension in Cursor or a VS Code-based editor, and your project folders hold .env files with private keys.\n\n## What to do now\n- Remove the extension and move funds from every wallet whose key was in a .env or config file on that machine.\n- Rotate API keys and tokens stored in those files.\n\n## How to avoid this\n- Keep only small test funds in development wallets, one per project, and hold real funds on hardware wallets.\n- Don't keep private keys in plain-text .env files; use a hardware signer or a secrets manager.\n- Install editor extensions only from verified publishers and check the exact extension ID, not just the name.",
 "notes": null,
 "agentBrief": "# Malicious 'contractshark.solidity-lang' Cursor extension steals an Ethereum core developer's private key\n\n- Severity: Medium · Status: Partly contained (past)\n- Chains: Ethereum · Method: Supply-chain stealers\n- Started: Aug 13, 2025 · Last update: Aug 13, 2025 · Victims: 1\n- Who/what: Cursor AI code editor users\n- AI involvement: AI agents as the target. The key-stealing extension was installed in Cursor, the AI code editor the developer used as a coding assistant; it read the .env file rather than abusing the AI itself.\n\nCointelegraph reported on 13 August 2025 that an Ethereum core developer's hot wallet was drained after he installed 'contractshark.solidity-lang', a fake Solidity extension for the Cursor AI code editor with over 54,000 downloads. The extension read his .env file and sent the private key to the attacker, who waited three days before emptying the wallet. The loss was a few hundred dollars because he kept only test funds there and his main holdings on hardware wallets. Keep keys out of .env files on development machines and use small, separate test wallets.\n\n## Am I affected?\nYou may be affected if you installed 'contractshark.solidity-lang' or another unofficial Solidity extension in Cursor or a VS Code-based editor, and your project folders hold .env files with private keys.\n\n## What to do now\n- Remove the extension and move funds from every wallet whose key was in a .env or config file on that machine.\n- Rotate API keys and tokens stored in those files.\n\n## How to avoid this\n- Keep only small test funds in development wallets, one per project, and hold real funds on hardware wallets.\n- Don't keep private keys in plain-text .env files; use a hardware signer or a secrets manager.\n- Install editor extensions only from verified publishers and check the exact extension ID, not just the name.\n\n## Sources\n- Ethereum core dev's crypto wallet drained by malicious AI extension (Cointelegraph, 2025-08-13): https://cointelegraph.com/news/core-ethereum-devs-crypto-wallet-drained-ai-extension\n\nFull record: https://drains.watch/i/cursor-contractshark-solidity-extension-dev-key-theft-aug-2025 · JSON: https://drains.watch/i/cursor-contractshark-solidity-extension-dev-key-theft-aug-2025.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}