{
 "tag": "supply-chain",
 "name": "Supply-chain stealers",
 "group": "Drain methods",
 "incidents": [
  {
   "slug": "ledger-cryptobilis-tampered-hardware-wallets",
   "title": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets",
   "json": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "tron",
    "ethereum",
    "bsc",
    "polygon",
    "solana",
    "bitcoin"
   ],
   "method": "supply-chain",
   "product": "Ledger hardware wallets (Nano X, Flex, Stax) bought from reseller CryptoBilis and some other third-party sellers",
   "tags": [
    "tron",
    "ethereum",
    "bsc",
    "polygon",
    "solana",
    "bitcoin",
    "supply-chain",
    "ledger",
    "hardware-wallet",
    "cryptobilis",
    "reseller",
    "hardware-implant",
    "seed-phrase-theft",
    "tether-freeze"
   ],
   "amountUsd": 102000000,
   "victims": 324,
   "startedAt": "2026-10-09",
   "closedAt": null,
   "updatedAt": "2026-10-16T12:00:00Z",
   "summary": "Ledger hardware wallets sold by CryptoBilis, a Southeast Asian reseller, had a hidden implant added after manufacture that read the 24-word recovery phrase during setup and sent it out over an LTE eSIM. Coordinated drains began on 9 October 2026 across TRON, Ethereum, BNB Chain, Polygon, Solana and Bitcoin. Bitquery's on-chain estimate is about $102M from 324 wallets, and investigator Specter put it above $86M. Ledger has not confirmed a figure. Anyone who set up a Ledger bought from a third-party seller in the affected markets should move funds to a new seed made on a device bought direct."
  },
  {
   "slug": "polymarket-frontend-vendor-compromise-jun-2026",
   "title": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained",
   "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026",
   "json": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "polygon",
    "ethereum"
   ],
   "method": "front-end-hijack",
   "product": "Polymarket web app users",
   "tags": [
    "polygon",
    "ethereum",
    "front-end-hijack",
    "polymarket",
    "supply-chain",
    "third-party-vendor",
    "injected-script",
    "pusd",
    "prediction-market"
   ],
   "amountUsd": 3000000,
   "victims": null,
   "startedAt": "2026-06-25",
   "closedAt": "2026-07-01",
   "updatedAt": "2026-07-01T12:00:00Z",
   "summary": "Polymarket disclosed on 25 June 2026 that a breached third-party vendor let attackers inject malicious code into its website for some users. Users who interacted with the compromised front-end had their pUSD (Polymarket's USDC-backed stablecoin) drained; Bubblemaps estimated about $3M taken from fewer than 15 users, and the funds were converted to ETH. Polymarket removed the code and says it will fully refund affected users."
  },
  {
   "slug": "injective-sdk-ts-npm-key-stealer-jun-2026",
   "title": "Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys",
   "url": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026",
   "json": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "supply-chain",
   "product": "npm package @injectivelabs/sdk-ts and 17 related @injectivelabs packages",
   "tags": [
    "multi-evm",
    "supply-chain",
    "npm",
    "injective",
    "sdk",
    "github-compromise",
    "seed-phrase-theft",
    "developer"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-06-08",
   "closedAt": "2026-07-09",
   "updatedAt": "2026-07-09T12:00:00Z",
   "summary": "Attackers who compromised Injective Labs' GitHub repository published @injectivelabs/sdk-ts 1.20.21 to npm, along with 17 related @injectivelabs packages pinned to it. The malicious build hooked the fromMnemonic and fromHex functions and sent seed phrases and private keys to an Injective-looking endpoint whenever an app used them. It was downloaded about 310 times before being deprecated; no thefts had been reported. Any key or seed that passed through 1.20.21 should be treated as stolen; the clean version is 1.20.23."
  },
  {
   "slug": "trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026",
   "title": "TrapDoor packages on npm, PyPI and Crates.io steal wallet data and plant hidden prompts for AI coding tools",
   "url": "https://drains.watch/i/trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026",
   "json": "https://drains.watch/i/trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The packages planted .cursorrules and CLAUDE.md files with hidden Unicode instructions meant to trick AI coding assistants into running steps that could find and exfiltrate secrets."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "supply-chain",
   "product": "Developers installing packages from npm, PyPI and Crates.io",
   "tags": [
    "multi-evm",
    "supply-chain",
    "trapdoor",
    "npm",
    "pypi",
    "crates-io",
    "ai-coding-agent",
    "cursor",
    "claude-code",
    "hidden-unicode",
    "infostealer",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-05-26",
   "closedAt": "2026-05-26",
   "updatedAt": "2026-05-26T12:00:00Z",
   "summary": "Socket reported in late May 2026 a campaign it named TrapDoor: more than 34 malicious packages and 384+ related versions across npm, PyPI and Crates.io that steal crypto wallet data and other developer secrets. The packages also tried to alter files that AI coding tools read, such as .cursorrules and CLAUDE.md, using hidden Unicode instructions meant to get the assistant to run scan-like steps that find and send out secrets. No confirmed losses or victim counts have been published. Developers who installed flagged packages should rotate credentials and move wallet funds."
  },
  {
   "slug": "latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026",
   "title": "Solana wallet MCP server on PyPI sent users' private keys to a remote server",
   "url": "https://drains.watch/i/latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026",
   "json": "https://drains.watch/i/latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The package was an MCP wallet server for AI agents; it auto-registered itself as an MCP server for Claude and sent the Solana private key to a remote server."
   },
   "chains": [
    "solana"
   ],
   "method": "supply-chain",
   "product": "latinum-wallet-mcp (PyPI)",
   "tags": [
    "solana",
    "supply-chain",
    "mcp",
    "mcp-server",
    "pypi",
    "claude",
    "ai-agent",
    "private-key",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-03-31",
   "closedAt": "2026-03-31",
   "updatedAt": "2026-03-31T12:00:00Z",
   "summary": "An advisory published on 31 March 2026 flagged latinum-wallet-mcp, a PyPI package that runs a Solana wallet as an MCP server for AI agents, as malicious. From version 0.0.32 it sent the wallet's private key, along with other metrics, to a remote server during wallet setup, and from 0.0.34 it added itself as an MCP server for Claude on import; none of this was in the public GitHub code. Versions 0.0.32 to 0.0.36 are listed as affected. Anyone who installed them should treat that Solana key as stolen and move funds to a new wallet."
  },
  {
   "slug": "npm-galedonovan-solana-key-stealers-mar-2026",
   "title": "Five typosquatted npm packages hook Base58 decoding to steal Solana and Ethereum private keys",
   "url": "https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026",
   "json": "https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "solana",
    "ethereum"
   ],
   "method": "supply-chain",
   "product": "npm packages raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet, base_xd",
   "tags": [
    "solana",
    "ethereum",
    "supply-chain",
    "npm",
    "typosquat",
    "bs58",
    "base58",
    "telegram-c2",
    "developers",
    "raydium"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-03-26",
   "closedAt": "2026-03-26",
   "updatedAt": "2026-03-26T12:00:00Z",
   "summary": "In March 2026, Cyber Press reported five malicious npm packages from the account 'galedonovan', aimed at crypto developers: raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet and base_xd. The Solana packages intercept Base58 decode() calls used to load keypairs and send the private key in plain text to a Telegram bot, while the app keeps working normally. The Ethereum package hooks the Wallet constructor. base_xd was pulled within five minutes, but the other four were still live when the report came out. Developers who installed any of them should rotate keys and move funds."
  },
  {
   "slug": "litellm-pypi-teampcp-credential-wallet-stealer-mar-2026",
   "title": "Compromised LiteLLM releases on PyPI steal cloud keys and crypto wallet data from AI developers",
   "url": "https://drains.watch/i/litellm-pypi-teampcp-credential-wallet-stealer-mar-2026",
   "json": "https://drains.watch/i/litellm-pypi-teampcp-credential-wallet-stealer-mar-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The trojanized package was LiteLLM, a gateway library used to connect AI apps and agents to LLMs, so an AI tool was the delivery route; no AI model was manipulated."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "supply-chain",
   "product": "LiteLLM on PyPI",
   "tags": [
    "multi-evm",
    "supply-chain",
    "litellm",
    "pypi",
    "teampcp",
    "llm-gateway",
    "ai-tooling",
    "infostealer",
    "trivy",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-03-24",
   "closedAt": "2026-03-24",
   "updatedAt": "2026-03-24T12:00:00Z",
   "summary": "On 24 March 2026 attackers tracked as TeamPCP published LiteLLM 1.82.7 and 1.82.8 to PyPI with hidden code that runs on import, and in 1.82.8 whenever Python starts. LiteLLM is a popular open-source gateway that AI apps and agents use to reach many LLM providers, with over 3.4 million downloads a day. The payload collected SSH keys, cloud credentials, Kubernetes secrets, .env files and crypto wallet data and sent them to a lookalike domain. Both versions were removed; anyone who installed them should rotate secrets and move funds from wallets on affected machines."
  },
  {
   "slug": "promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026",
   "title": "Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent",
   "url": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026",
   "json": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The malicious dependency entered an AI trading agent through a commit co-authored by Claude Opus, and ReversingLabs assesses the attackers wrote promotional package pages to lure AI coding agents."
   },
   "chains": [
    "solana"
   ],
   "method": "supply-chain",
   "product": "AI trading agent projects and Web3 developers on npm",
   "tags": [
    "solana",
    "supply-chain",
    "npm",
    "pypi",
    "ai-coding-agent",
    "claude",
    "ai-trading-bot",
    "famous-chollima",
    "north-korea",
    "dprk",
    "promptmink",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-02-28",
   "closedAt": "2026-04-29",
   "updatedAt": "2026-04-29T12:00:00Z",
   "summary": "ReversingLabs reported on 29 April 2026 that a 28 February commit to openpaw-graveyard, an autonomous crypto trading agent built for Solana, was co-authored by Claude Opus and added a bait package (@solana-launchpad/sdk) that silently pulled in the malicious @validate-sdk/v2. The payload steals .env and JSON files and crypto wallet credentials, and adds attacker SSH keys for remote access. ReversingLabs ties the campaign, 60+ packages and 300+ versions over about seven months, to North Korea's Famous Chollima and believes it deliberately targets AI coding agents. No losses were reported; check lockfiles for the named packages and rotate keys on affected machines."
  },
  {
   "slug": "openclaw-clawhub-malicious-skills-solana-phantom-feb-2026",
   "title": "Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys",
   "url": "https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026",
   "json": "https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "Malicious skills for the OpenClaw AI agent posed as Solana, Phantom and other crypto tools; some delivered the AMOS stealer and Solana keys were exposed in plain-text keypair files."
   },
   "chains": [
    "solana",
    "multi-evm"
   ],
   "method": "supply-chain",
   "product": "OpenClaw (ClawHub) skill users",
   "tags": [
    "solana",
    "multi-evm",
    "supply-chain",
    "openclaw",
    "clawhub",
    "ai-agent",
    "skills",
    "amos-stealer",
    "macos",
    "infostealer",
    "phantom",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-02-05",
   "closedAt": null,
   "updatedAt": "2026-10-22T21:53:35.016Z",
   "summary": "Bitdefender found that about 17% of the OpenClaw (ClawHub) AI-agent skills it analyzed in the first week of February 2026 behaved maliciously. Solana-themed skills made up 9.3% of the malicious set and Phantom-wallet skills 8.2%. Some skills told users to run fake installers that dropped the AMOS macOS stealer. Solana skills that read SOLANA_KEYPAIR_PATH can expose the plain-text keypair file that holds a wallet's private key. Payloads were staged on 91.92.242[.]30 and an impersonated OpenClaw GitHub repo. Anyone who installed crypto skills and ran their setup commands should move funds to a new wallet."
  },
  {
   "slug": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "title": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "json": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "solana",
    "bitcoin",
    "ethereum"
   ],
   "method": "malicious-extension",
   "product": "Trust Wallet Chrome extension v2.68",
   "tags": [
    "solana",
    "bitcoin",
    "ethereum",
    "malicious-extension",
    "trust-wallet",
    "browser-extension",
    "chrome-web-store",
    "seed-phrase",
    "leaked-api-key",
    "wallet",
    "supply-chain",
    "shai-hulud",
    "npm",
    "seed-phrase-theft"
   ],
   "amountUsd": 8500000,
   "victims": 2520,
   "startedAt": "2025-12-24",
   "closedAt": "2025-12-25",
   "updatedAt": "2025-12-31T12:00:00Z",
   "summary": "A malicious version 2.68 of the Trust Wallet browser extension was published to the Chrome Web Store on Dec 24, 2025 with a leaked store API key, skipping the normal release review. It harvested seed phrases through a modified analytics library and sent them to metrics-trustwallet[.]com. Early reports put losses near $7M; Trust Wallet's post-mortem says about $8.5M was drained from 2,520 wallet addresses across BTC, ETH and SOL, and traces the leak to the Shai-Hulud 2.0 npm worm. The fixed v2.69 shipped on Dec 25 and Trust Wallet says it will reimburse affected users; mobile app users were not affected."
  },
  {
   "slug": "nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "title": "Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files",
   "url": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "json": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "The malware ran locally installed AI CLIs (Claude, Gemini, Amazon Q) to inventory wallet, keystore and secret files for theft; Wiz found the AI step worked in under a quarter of cases and saw no successful crypto exfiltration."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "supply-chain",
   "product": "Nx build system on npm",
   "tags": [
    "multi-evm",
    "supply-chain",
    "nx",
    "npm",
    "s1ngularity",
    "ai-cli",
    "claude-code",
    "gemini-cli",
    "amazon-q",
    "keystore",
    "github-tokens",
    "github-actions",
    "infostealer",
    "wiz",
    "ai"
   ],
   "amountUsd": null,
   "victims": 1700,
   "startedAt": "2025-08-26",
   "closedAt": "2025-09-06",
   "updatedAt": "2025-09-06T12:00:00Z",
   "summary": "Around 26 August 2025 malicious versions of Nx, a widely used JavaScript build tool, were published to npm and stole GitHub and npm tokens on install. The malware also looked for installed AI command-line tools (Claude, Gemini and Amazon Q) and ran them to search the disk for crypto wallet and keystore files, .env files and SSH keys, then published the results to repos in the victim's own GitHub account. Wiz counted over 1,700 users with leaked secrets and over 6,700 private repos made public, but saw no successful crypto theft, partly because the AI tools often refused. Anyone who installed the bad versions should rotate tokens and move funds from wallet files on that machine."
  },
  {
   "slug": "cursor-contractshark-solidity-extension-dev-key-theft-aug-2025",
   "title": "Malicious 'contractshark.solidity-lang' Cursor extension steals an Ethereum core developer's private key",
   "url": "https://drains.watch/i/cursor-contractshark-solidity-extension-dev-key-theft-aug-2025",
   "json": "https://drains.watch/i/cursor-contractshark-solidity-extension-dev-key-theft-aug-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The key-stealing extension was installed in Cursor, the AI code editor the developer used as a coding assistant; it read the .env file rather than abusing the AI itself."
   },
   "chains": [
    "ethereum"
   ],
   "method": "supply-chain",
   "product": "Cursor AI code editor users",
   "tags": [
    "ethereum",
    "supply-chain",
    "cursor",
    "ai-code-editor",
    "malicious-extension",
    "solidity",
    "env-file",
    "private-key",
    "developers",
    "ai"
   ],
   "amountUsd": null,
   "victims": 1,
   "startedAt": "2025-08-13",
   "closedAt": "2025-08-13",
   "updatedAt": "2025-08-13T12:00:00Z",
   "summary": "Cointelegraph reported on 13 August 2025 that an Ethereum core developer's hot wallet was drained after he installed 'contractshark.solidity-lang', a fake Solidity extension for the Cursor AI code editor with over 54,000 downloads. The extension read his .env file and sent the private key to the attacker, who waited three days before emptying the wallet. The loss was a few hundred dollars because he kept only test funds there and his main holdings on hardware wallets. Keep keys out of .env files on development machines and use small, separate test wallets."
  },
  {
   "slug": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "title": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads",
   "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "json": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "contained",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "Safety's researchers say the code appears largely AI-generated, citing emojis, heavy comments and logging they link to Anthropic's Claude; this is an inference from code style."
   },
   "chains": [
    "solana"
   ],
   "method": "supply-chain",
   "product": "npm package @kodane/patch-manager",
   "tags": [
    "solana",
    "supply-chain",
    "npm",
    "kodane",
    "ai-generated-code",
    "claude",
    "wallet-drainer",
    "postinstall",
    "safety",
    "railway",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-07-28",
   "closedAt": "2025-07-30",
   "updatedAt": "2025-08-01T12:00:00Z",
   "summary": "On 28 July 2025 an npm package called @kodane/patch-manager, posing as a license-validation and registry cache tool for Node.js, was published with a hidden wallet drainer in its install script. Once installed it looked for crypto wallets on Windows, macOS and Linux and sent the funds to a Solana address, leaving just enough for fees. It was downloaded more than 1,500 times before npm flagged it on 30 July; Safety, which found it, said the code appears to be largely AI-generated. No total loss was published."
  },
  {
   "slug": "cursor-fake-solidity-extension-500k-crypto-theft-jul-2025",
   "title": "Fake Solidity extension for the Cursor AI code editor leads to about $500K crypto theft from a developer",
   "url": "https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025",
   "json": "https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The malicious extension reached the victim through the extension marketplace used by Cursor, an AI-powered code editor; the AI features themselves were not exploited."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "supply-chain",
   "product": "Cursor AI code editor users (Open VSX extensions)",
   "tags": [
    "multi-evm",
    "supply-chain",
    "cursor",
    "ai-code-editor",
    "open-vsx",
    "malicious-extension",
    "solidity",
    "screenconnect",
    "quasar",
    "infostealer",
    "developers",
    "ai"
   ],
   "amountUsd": 500000,
   "victims": 1,
   "startedAt": "2025-07-10",
   "closedAt": "2025-07-10",
   "updatedAt": "2025-07-10T12:00:00Z",
   "summary": "Kaspersky reported on 10 July 2025 that a blockchain developer lost about $500,000 in crypto after installing a fake Solidity extension in Cursor, an AI code editor built on VS Code that gets extensions from the Open VSX registry. The extension gave no Solidity support; it installed ScreenConnect remote-access software, then the Quasar backdoor and a stealer that took browser, email and wallet data, including seed phrases. The attackers used the seed phrases to drain the developer's wallets. Developers should vet editor extensions and never keep seed phrases or funded keys on a coding machine."
  }
 ],
 "changes": [
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-16",
   "title": "Rekt, citing Bitquery, put losses at about $102 million from 324 wallets and reported Tether had frozen about $10 million across 20 addresses.",
   "sourceUrl": "https://rekt.news/factory-sealed",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-14",
   "title": "Ledger told distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to halt sales; MediaMarkt in Europe pulled Ledger devices after user reports, and Trezor said it is cutting its reseller network.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-13",
   "title": "Ledger's Donjon team published implant details: a separate microcontroller decodes the recovery phrase and sends it over LTE without touching the Secure Element, so integrity checks do not detect it.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-11",
   "title": "Investigator Specter estimated losses may exceed $86 million across Bitcoin, Ethereum and Tron; Ledger said its own infrastructure was not compromised.",
   "sourceUrl": "https://cointelegraph.com/news/ledger-confirms-unauthorized-hardware-implant-losses-may-exceed-86m",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-10",
   "title": "Ledger confirmed that at least one affected device contained an unauthorized hardware implant.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-09",
   "title": "Coordinated drains began at 04:59 UTC with a new key added to 30 TRON wallets, then spread to Ethereum, BNB Chain, Polygon, Solana and Bitcoin within 47 minutes.",
   "sourceUrl": "https://rekt.news/factory-sealed",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "ledger-cryptobilis-tampered-hardware-wallets",
   "incidentTitle": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-09",
   "title": "Ledger opened an investigation into user reports of unexpected fund losses and asked CryptoBilis to stop selling and shipping devices.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/",
   "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets"
  },
  {
   "incident": "injective-sdk-ts-npm-key-stealer-jun-2026",
   "incidentTitle": "Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-07-09",
   "title": "Socket published its analysis: the payload hooks fromMnemonic and fromHex, 17 more packages pinned the bad version, the malicious release had 310 downloads, and 1.20.23 is clean.",
   "sourceUrl": "https://socket.dev/blog/compromised-injective-sdk-npm-package",
   "url": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026"
  },
  {
   "incident": "injective-sdk-ts-npm-key-stealer-jun-2026",
   "incidentTitle": "Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-07-09",
   "title": "BleepingComputer reported the compromise and advised affected developers to move funds to new wallets and rotate all secrets.",
   "sourceUrl": "https://bleepingcomputer.com/news/security/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer",
   "url": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026"
  },
  {
   "incident": "polymarket-frontend-vendor-compromise-jun-2026",
   "incidentTitle": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-07-01",
   "title": "Halborn's June review listed the vendor-driven front-end attack at about $3M stolen from site visitors.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-june-2026",
   "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026"
  },
  {
   "incident": "polymarket-frontend-vendor-compromise-jun-2026",
   "incidentTitle": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-06-26",
   "title": "Bubblemaps estimated about $3M stolen from fewer than 15 users; PeckShield said victims' pUSD was drained and the funds were converted to ETH.",
   "sourceUrl": "https://unchainedcrypto.com/polymarket-users-lose-estimated-3-million-in-front-end-exploit/",
   "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026"
  },
  {
   "incident": "polymarket-frontend-vendor-compromise-jun-2026",
   "incidentTitle": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-06-25",
   "title": "Polymarket said a third-party vendor was compromised and malicious code was injected into its website; it removed the code, patched the issue and promised full refunds.",
   "sourceUrl": "https://unchainedcrypto.com/polymarket-users-lose-estimated-3-million-in-front-end-exploit/",
   "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026"
  },
  {
   "incident": "injective-sdk-ts-npm-key-stealer-jun-2026",
   "incidentTitle": "Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-06-08",
   "title": "The attacker made the first suspicious commits to the Injective SDK repository and published the malicious version shortly after.",
   "sourceUrl": "https://bleepingcomputer.com/news/security/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer",
   "url": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026"
  },
  {
   "incident": "trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026",
   "incidentTitle": "TrapDoor packages on npm, PyPI and Crates.io steal wallet data and plant hidden prompts for AI coding tools",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-05-26",
   "title": "CSO Online reported Socket's TrapDoor findings: 34+ malicious packages across three registries that steal wallet data and poison AI assistant config files.",
   "sourceUrl": "https://www.csoonline.com/article/4177019/trapdoor-malware-campaign-puts-developer-workstations-in-ciso-spotlight.html",
   "url": "https://drains.watch/i/trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026"
  },
  {
   "incident": "promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026",
   "incidentTitle": "Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-04-29",
   "title": "ReversingLabs published its findings and linked the campaign to Famous Chollima.",
   "sourceUrl": "https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto",
   "url": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026"
  },
  {
   "incident": "latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026",
   "incidentTitle": "Solana wallet MCP server on PyPI sent users' private keys to a remote server",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-03-31",
   "title": "Malicious-package advisory MAL-2026-2315 was published for latinum-wallet-mcp versions 0.0.32 to 0.0.36.",
   "sourceUrl": "https://osv.dev/vulnerability/MAL-2026-2315",
   "url": "https://drains.watch/i/latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026"
  },
  {
   "incident": "npm-galedonovan-solana-key-stealers-mar-2026",
   "incidentTitle": "Five typosquatted npm packages hook Base58 decoding to steal Solana and Ethereum private keys",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-03-26",
   "title": "Cyber Press reported five 'galedonovan' npm packages that exfiltrate Solana and Ethereum private keys to a Telegram bot; four were still live.",
   "sourceUrl": "https://cyberpress.org/telegram-attack-targets-crypto-developers/",
   "url": "https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026"
  },
  {
   "incident": "litellm-pypi-teampcp-credential-wallet-stealer-mar-2026",
   "incidentTitle": "Compromised LiteLLM releases on PyPI steal cloud keys and crypto wallet data from AI developers",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-03-24",
   "title": "Malicious LiteLLM 1.82.7 and 1.82.8 were published to PyPI with a credential and wallet stealer, and were later removed.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/popular-litellm-pypi-package-compromised-in-teampcp-supply-chain-attack/",
   "url": "https://drains.watch/i/litellm-pypi-teampcp-credential-wallet-stealer-mar-2026"
  },
  {
   "incident": "promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026",
   "incidentTitle": "Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-02-28",
   "title": "A commit co-authored by Claude Opus added @solana-launchpad/sdk to the openpaw-graveyard trading agent, pulling in the malicious @validate-sdk/v2.",
   "sourceUrl": "https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto",
   "url": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026"
  },
  {
   "incident": "openclaw-clawhub-malicious-skills-solana-phantom-feb-2026",
   "incidentTitle": "Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys",
   "severity": "high",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-02-05",
   "title": "Bitdefender Labs published its analysis of malicious OpenClaw skills, including Solana- and Phantom-themed lures that delivered the AMOS stealer.",
   "sourceUrl": "https://www.bitdefender.com/en-au/blog/labs/helpful-skills-or-hidden-payloads-bitdefender-labs-dives-deep-into-the-openclaw-malicious-skill-trap",
   "url": "https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-31",
   "title": "SecurityWeek reported Trust Wallet's post-mortem: the Shai-Hulud 2.0 worm leaked developer GitHub secrets; $8.5M was drained from 2,520 addresses; users who logged in between 24 and 26 December were affected; all affected users will be reimbursed.",
   "sourceUrl": "https://www.securityweek.com/shai-hulud-supply-chain-attack-led-to-8-5-million-trust-wallet-heist/",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-27",
   "title": "Trust Wallet launched a compensation claims process for about $7M in losses and warned of fake compensation forms.",
   "sourceUrl": "https://www.theblock.co/amp/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-26",
   "title": "CyberInsider reported that the exfiltration domain metrics-trustwallet[.]com had been registered days before the breach and was taken offline.",
   "sourceUrl": "https://cyberinsider.com/trust-wallet-suffers-supply-chain-compromise-millions-in-crypto-stolen/",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-25",
   "title": "ZachXBT warned that over $6M had been stolen from hundreds of users; Trust Wallet confirmed the v2.68 incident and released the fixed v2.69.",
   "sourceUrl": "https://www.theblock.co/post/383735/trust-wallet-extension-incident",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
   "incidentTitle": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-24",
   "title": "Malicious Trust Wallet extension v2.68 was published to the Chrome Web Store at 12:32 UTC using a leaked store API key, bypassing the normal release process.",
   "sourceUrl": "https://www.theblock.co/amp/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims",
   "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025"
  },
  {
   "incident": "nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "incidentTitle": "Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-09-06",
   "title": "BleepingComputer reported Wiz's tally of 2,180 exposed accounts and 7,200 repositories across three phases.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ai-powered-malware-hit-2-180-github-accounts-in-s1ngularity-attack/",
   "url": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025"
  },
  {
   "incident": "nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "incidentTitle": "Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-09-03",
   "title": "Wiz published its analysis: over 1,700 users had secrets leaked, over 6,700 private repos were exposed, and no successful crypto exfiltration had been seen.",
   "sourceUrl": "https://www.wiz.io/blog/s1ngularitys-aftermath",
   "url": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025"
  },
  {
   "incident": "nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "incidentTitle": "Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-08-26",
   "title": "News broke that malicious Nx versions on npm were stealing tokens and using local AI CLIs to search for wallet and secret files.",
   "sourceUrl": "https://www.wiz.io/blog/s1ngularitys-aftermath",
   "url": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025"
  },
  {
   "incident": "nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "incidentTitle": "Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-08-26",
   "title": "Malicious Nx versions with a data-stealing postinstall script were published to npm.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ai-powered-malware-hit-2-180-github-accounts-in-s1ngularity-attack/",
   "url": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025"
  },
  {
   "incident": "cursor-contractshark-solidity-extension-dev-key-theft-aug-2025",
   "incidentTitle": "Malicious 'contractshark.solidity-lang' Cursor extension steals an Ethereum core developer's private key",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-08-13",
   "title": "Cointelegraph reported that a malicious Cursor extension had taken an Ethereum core developer's private key and the hot wallet was drained the previous Sunday.",
   "sourceUrl": "https://cointelegraph.com/news/core-ethereum-devs-crypto-wallet-drained-ai-extension",
   "url": "https://drains.watch/i/cursor-contractshark-solidity-extension-dev-key-theft-aug-2025"
  },
  {
   "incident": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "incidentTitle": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-08-01",
   "title": "The Register reported more than 1,500 downloads and the signs of AI-written code.",
   "sourceUrl": "https://www.theregister.com/2025/08/01/emoji_use_ai_malware/",
   "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025"
  },
  {
   "incident": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "incidentTitle": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-07-31",
   "title": "Safety published its analysis, including the attacker's Solana address and an open command server.",
   "sourceUrl": "https://www.getsafety.com/blog-posts/threat-actor-uses-ai-to-create-a-better-crypto-wallet-drainer",
   "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025"
  },
  {
   "incident": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "incidentTitle": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-07-30",
   "title": "npm marked the package as malicious.",
   "sourceUrl": "https://www.getsafety.com/blog-posts/threat-actor-uses-ai-to-create-a-better-crypto-wallet-drainer",
   "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025"
  },
  {
   "incident": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "incidentTitle": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-07-28",
   "title": "The package was first published to npm; 19 versions followed over two days.",
   "sourceUrl": "https://www.getsafety.com/blog-posts/threat-actor-uses-ai-to-create-a-better-crypto-wallet-drainer",
   "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025"
  },
  {
   "incident": "cursor-fake-solidity-extension-500k-crypto-theft-jul-2025",
   "incidentTitle": "Fake Solidity extension for the Cursor AI code editor leads to about $500K crypto theft from a developer",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-07-10",
   "title": "Kaspersky disclosed that a fake Solidity extension aimed at Cursor users led to about $500,000 in stolen crypto from a blockchain developer.",
   "sourceUrl": "https://www.kaspersky.com/about/press-releases/kaspersky-uncovers-500k-crypto-heist-through-malicious-packages-targeting-cursor-developers",
   "url": "https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025"
  }
 ]
}