Fake Solidity extension for the Cursor AI code editor leads to about $500K crypto theft from a developer
Cursor AI code editor users (Open VSX extensions)
Kaspersky reported on 10 July 2025 that a blockchain developer lost about $500,000 in crypto after installing a fake Solidity extension in Cursor, an AI code editor built on VS Code that gets extensions from the Open VSX registry. The extension gave no Solidity support; it installed ScreenConnect remote-access software, then the Quasar backdoor and a stealer that took browser, email and wallet data, including seed phrases. The attackers used the seed phrases to drain the developer's wallets. Developers should vet editor extensions and never keep seed phrases or funded keys on a coding machine.
Why this severity: $500K reported stolen, 1 victims, only partly contained.
AI involvement
AI agents as the target. The malicious extension reached the victim through the extension marketplace used by Cursor, an AI-powered code editor; the AI features themselves were not exploited.
Give agents a small, capped wallet with allow-listed destinations, and never let an agent that can sign read untrusted content.
- Started
- Jul 10, 2025
- Closed
- Jul 10, 2025
- Chains
- Multiple EVM chains
- Method
- Supply-chain stealers
- Reported stolen
- $500K
- Victims
- 1
At risk
- Cursor AI code editor users (Open VSX extensions)
- Multiple EVM chains wallets
What to do now
- From a clean device, create new wallets and move your funds; assume seed phrases and browser-saved passwords on that machine are stolen.
- Remove the extension and any ScreenConnect install you did not set up, and reinstall the operating system if you can.
Stay safe
Am I affected?
You may be affected if you installed a Solidity extension in Cursor or another VS Code-based editor from Open VSX in mid-2025 and it never actually added Solidity support. ScreenConnect on your machine that you did not install is a warning sign.
What to do now
- From a clean device, create new wallets and move your funds; assume seed phrases and browser-saved passwords on that machine are stolen.
- Remove the extension and any ScreenConnect install you did not set up, and reinstall the operating system if you can.
How to avoid this
- Check an extension's publisher, source repo and history before installing; download counts can be faked.
- Never store seed phrases or funded keys on a development machine; use a hardware wallet.
- Do contract work in a separate VM or machine that holds only small test balances.
Timeline 1
Kaspersky disclosed that a fake Solidity extension aimed at Cursor users led to about $500,000 in stolen crypto from a blockchain developer.
Source
Alerts & on-chain evidence 1
How this method works
A popular code package or app update is hijacked to steal wallet keys or swap addresses, hitting everyone who installs it. Read about supply-chain stealers →
Follow new drains and updates in your feed reader or Telegram RSS bot.