Developers
3 incidents, 0 live. 210 days since the last new one.
1 drains in the last 12 months
1 drains in the last 12 months
1 drains in 2026
2 drains in 2025
Past
March 2026 1
-
Medium◐Partly contained
Five typosquatted npm packages hook Base58 decoding to steal Solana and Ethereum private keys
In March 2026, Cyber Press reported five malicious npm packages from the account 'galedonovan', aimed at crypto developers: raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet and base_xd. The Solana packages intercept Base58 decode() calls used to load keypairs and send the private key in plain text to a Telegram bot, while the app keeps working normally. The Ethereum package hooks the Wallet constructor. base_xd was pulled within five minutes, but the other four were still live when the report came out. Developers who installed any of them should rotate keys and move funds.
npm packages raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet, base_xd·Solana, Ethereum·Since Mar 26, 2026·
August 2025 1
-
Malicious 'contractshark.solidity-lang' Cursor extension steals an Ethereum core developer's private key
Cointelegraph reported on 13 August 2025 that an Ethereum core developer's hot wallet was drained after he installed 'contractshark.solidity-lang', a fake Solidity extension for the Cursor AI code editor with over 54,000 downloads. The extension read his .env file and sent the private key to the attacker, who waited three days before emptying the wallet. The loss was a few hundred dollars because he kept only test funds there and his main holdings on hardware wallets. Keep keys out of .env files on development machines and use small, separate test wallets.
Cursor AI code editor users·Ethereum·Since Aug 13, 2025·
July 2025 1
-
Fake Solidity extension for the Cursor AI code editor leads to about $500K crypto theft from a developer
Kaspersky reported on 10 July 2025 that a blockchain developer lost about $500,000 in crypto after installing a fake Solidity extension in Cursor, an AI code editor built on VS Code that gets extensions from the Open VSX registry. The extension gave no Solidity support; it installed ScreenConnect remote-access software, then the Quasar backdoor and a stealer that took browser, email and wallet data, including seed phrases. The attackers used the seed phrases to drain the developer's wallets. Developers should vet editor extensions and never keep seed phrases or funded keys on a coding machine.
Cursor AI code editor users (Open VSX extensions)·Multiple EVM chains·$500K stolen·Since Jul 10, 2025·
No drains match these filters.