{
 "slug": "cursor-fake-solidity-extension-500k-crypto-theft-jul-2025",
 "title": "Fake Solidity extension for the Cursor AI code editor leads to about $500K crypto theft from a developer",
 "url": "https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025",
 "json": "https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025.json",
 "status": "closed",
 "severity": "high",
 "threatStatus": "partly-contained",
 "verification": "verified",
 "ai": {
  "role": "agent-target",
  "note": "The malicious extension reached the victim through the extension marketplace used by Cursor, an AI-powered code editor; the AI features themselves were not exploited."
 },
 "chains": [
  "multi-evm"
 ],
 "method": "supply-chain",
 "product": "Cursor AI code editor users (Open VSX extensions)",
 "tags": [
  "multi-evm",
  "supply-chain",
  "cursor",
  "ai-code-editor",
  "open-vsx",
  "malicious-extension",
  "solidity",
  "screenconnect",
  "quasar",
  "infostealer",
  "developers",
  "ai"
 ],
 "amountUsd": 500000,
 "victims": 1,
 "startedAt": "2025-07-10",
 "closedAt": "2025-07-10",
 "updatedAt": "2025-07-10T12:00:00Z",
 "summary": "Kaspersky reported on 10 July 2025 that a blockchain developer lost about $500,000 in crypto after installing a fake Solidity extension in Cursor, an AI code editor built on VS Code that gets extensions from the Open VSX registry. The extension gave no Solidity support; it installed ScreenConnect remote-access software, then the Quasar backdoor and a stealer that took browser, email and wallet data, including seed phrases. The attackers used the seed phrases to drain the developer's wallets. Developers should vet editor extensions and never keep seed phrases or funded keys on a coding machine.",
 "timeline": [
  {
   "date": "2025-07-10",
   "title": "Kaspersky disclosed that a fake Solidity extension aimed at Cursor users led to about $500,000 in stolen crypto from a blockchain developer.",
   "sourceUrl": "https://www.kaspersky.com/about/press-releases/kaspersky-uncovers-500k-crypto-heist-through-malicious-packages-targeting-cursor-developers"
  }
 ],
 "sources": [
  {
   "kind": "advisory",
   "title": "Kaspersky uncovers $500K crypto heist through malicious packages targeting Cursor developers",
   "url": "https://www.kaspersky.com/about/press-releases/kaspersky-uncovers-500k-crypto-heist-through-malicious-packages-targeting-cursor-developers",
   "publisher": "Kaspersky",
   "date": "2025-07-10"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nYou may be affected if you installed a Solidity extension in Cursor or another VS Code-based editor from Open VSX in mid-2025 and it never actually added Solidity support. ScreenConnect on your machine that you did not install is a warning sign.\n\n## What to do now\n- From a clean device, create new wallets and move your funds; assume seed phrases and browser-saved passwords on that machine are stolen.\n- Remove the extension and any ScreenConnect install you did not set up, and reinstall the operating system if you can.\n\n## How to avoid this\n- Check an extension's publisher, source repo and history before installing; download counts can be faked.\n- Never store seed phrases or funded keys on a development machine; use a hardware wallet.\n- Do contract work in a separate VM or machine that holds only small test balances.",
 "notes": null,
 "agentBrief": "# Fake Solidity extension for the Cursor AI code editor leads to about $500K crypto theft from a developer\n\n- Severity: High · Status: Partly contained (past)\n- Chains: Multiple EVM chains · Method: Supply-chain stealers\n- Started: Jul 10, 2025 · Last update: Jul 10, 2025 · Reported stolen: $500K · Victims: 1\n- Who/what: Cursor AI code editor users (Open VSX extensions)\n- AI involvement: AI agents as the target. The malicious extension reached the victim through the extension marketplace used by Cursor, an AI-powered code editor; the AI features themselves were not exploited.\n\nKaspersky reported on 10 July 2025 that a blockchain developer lost about $500,000 in crypto after installing a fake Solidity extension in Cursor, an AI code editor built on VS Code that gets extensions from the Open VSX registry. The extension gave no Solidity support; it installed ScreenConnect remote-access software, then the Quasar backdoor and a stealer that took browser, email and wallet data, including seed phrases. The attackers used the seed phrases to drain the developer's wallets. Developers should vet editor extensions and never keep seed phrases or funded keys on a coding machine.\n\n## Am I affected?\nYou may be affected if you installed a Solidity extension in Cursor or another VS Code-based editor from Open VSX in mid-2025 and it never actually added Solidity support. ScreenConnect on your machine that you did not install is a warning sign.\n\n## What to do now\n- From a clean device, create new wallets and move your funds; assume seed phrases and browser-saved passwords on that machine are stolen.\n- Remove the extension and any ScreenConnect install you did not set up, and reinstall the operating system if you can.\n\n## How to avoid this\n- Check an extension's publisher, source repo and history before installing; download counts can be faked.\n- Never store seed phrases or funded keys on a development machine; use a hardware wallet.\n- Do contract work in a separate VM or machine that holds only small test balances.\n\n## Sources\n- Kaspersky uncovers $500K crypto heist through malicious packages targeting Cursor developers (Kaspersky, 2025-07-10): https://www.kaspersky.com/about/press-releases/kaspersky-uncovers-500k-crypto-heist-through-malicious-packages-targeting-cursor-developers\n\nFull record: https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025 · JSON: https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}