# Supply-chain stealers · Drain Watch

14 incidents, 2 live. JSON: https://drains.watch/t/supply-chain.json · RSS: https://drains.watch/t/supply-chain/feed.xml

- [Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M](https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets) (live, Critical, Partly contained, since Oct 9, 2026)
- [Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained](https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026) (closed, Critical, Contained, since Jun 25, 2026)
- [Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys](https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026) (closed, High, Contained, since Jun 8, 2026)
- [TrapDoor packages on npm, PyPI and Crates.io steal wallet data and plant hidden prompts for AI coding tools](https://drains.watch/i/trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026) (closed, High, Partly contained, since May 26, 2026)
- [Solana wallet MCP server on PyPI sent users' private keys to a remote server](https://drains.watch/i/latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026) (closed, Medium, Partly contained, since Mar 31, 2026)
- [Five typosquatted npm packages hook Base58 decoding to steal Solana and Ethereum private keys](https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026) (closed, Medium, Partly contained, since Mar 26, 2026)
- [Compromised LiteLLM releases on PyPI steal cloud keys and crypto wallet data from AI developers](https://drains.watch/i/litellm-pypi-teampcp-credential-wallet-stealer-mar-2026) (closed, Critical, Contained, since Mar 24, 2026)
- [Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent](https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026) (closed, Medium, Still active, since Feb 28, 2026)
- [Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys](https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026) (live, High, Partly contained, since Feb 5, 2026)
- [Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets](https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025) (closed, Critical, Contained, since Dec 24, 2025)
- [Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files](https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025) (closed, Critical, Contained, since Aug 26, 2025)
- [Malicious 'contractshark.solidity-lang' Cursor extension steals an Ethereum core developer's private key](https://drains.watch/i/cursor-contractshark-solidity-extension-dev-key-theft-aug-2025) (closed, Medium, Partly contained, since Aug 13, 2025)
- [AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads](https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025) (closed, High, Contained, since Jul 28, 2025)
- [Fake Solidity extension for the Cursor AI code editor leads to about $500K crypto theft from a developer](https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025) (closed, High, Partly contained, since Jul 10, 2025)