BPOI Banner
1inch Frontend Compromised in Widespread Supply Chain Attack  1inch Frontend Compromised in Widespread Supply Chain Attack 

1Inch Website Hacked via Supply Chain Exploit on Lottie Player

Decentralized exchange aggregator 1inch’s website has been breached along with multiple other platforms that use the same frontend library, Lottie Player. 

The breach originated from malicious code injected into the Lottie Player, a widely-used animation library used by several dApps and non-crypto websites. As of now, no user wallets have been reportedly compromised.  

1inch Users Cautioned Against Any Interactions

According to several posts on X (formerly Twitter), 1inch and TEN Finance are the confirmed victims of this attack so far. However, the number could be much higher, as the exploit targeted Lottie Player versions 2.0.5 and above. 

Hackers have reportedly injected malicious code into the front-end JSON files of websites using these versions. This code now enables the compromised sites to perform unauthorized transactions, posing a severe threat to users’ assets and data.

Read More: 9 Crypto Wallet Security Tips To Safeguard Your Assets

Reports from Blockaid indicate that the attack was introduced through a compromise of Lottie Player’s content server, where a malicious npm package was used to distribute altered code. Blockaid and other security firms have confirmed the injection of unauthorized scripts within the package.

“Legitimate sites (non crypto as well) are now serving malicious content, including anti-debug evasion code. @LottieFiles, it looks like attackers have managed to push malicious versions of your package, with another version being uploaded now,” Blockaid wrote in an X (formerly Twitter) post

At the time of writing, 1inch hasn’t released any official statement on the breach. However, the Lottie Player team has confirmed that they were able to identify the cause of the breach and are working on removing the affected versions.

Users are strictly advised to avoid connecting wallets or interacting with affected platforms until the security issues are fully resolved.

Community post on the 1inch Discord channel

Crypto Hacks Continue To Escalate 

Security breaches have been the most plaguing issue of the crypto industry, and malicious activities continue to grow every year. 

Most recently, hackers reportedly stole $20 million worth of cryptocurrencies from the US government. The funds were also part of the $3.6 billion that the feds seized from the Bitfinex hackers.

Blockchain lender Radiant Capital suffered one of the biggest hacks of this year, losing more than $50 million. The hackers gained control of the firm’s private keys and rapidly drained these assets. 

Read More: Crypto Social Media Scams – How to Stay Safe

However, the investigation and prosecution of these crimes have also intensified. FBT recently arrested the SEC X (formerly Twitter) account hacker. The accused is a 25-year-old Alabama man named Eric Council Jr.

Earlier this year, the Council allegedly hacked the SEC’s X account and posted false news about Bitcoin ETF approvals, which significantly affected the market. Yet, the feds believe Council wasn’t the brains of this operation and they are trying to negotiate a plea deal with him. 

So far, crypto hacks have exceeded $2.1 billion in 2024, with CeFi platforms taking the biggest hits. 

Disclaimer

In adherence to the Trust Project guidelines, BeInCrypto is committed to unbiased, transparent reporting. This news article aims to provide accurate, timely information. However, readers are advised to verify facts independently and consult with a professional before making any decisions based on this content. Please note that our Terms and ConditionsPrivacy Policy, and Disclaimers have been updated.

Source link

Mohammad Shahid

https://beincrypto.com/1inch-website-hacked-in-supply-chain-attack/

2024-10-31 01:40:03

bitcoin
Bitcoin (BTC) $ 69,517.63 1.94%
ethereum
Ethereum (ETH) $ 2,485.14 3.01%
tether
Tether (USDT) $ 0.99945 0.14%
bnb
BNB (BNB) $ 567.99 2.78%
solana
Solana (SOL) $ 165.05 4.14%
usd-coin
USDC (USDC) $ 0.99986 0.22%
xrp
XRP (XRP) $ 0.510624 1.96%
staked-ether
Lido Staked Ether (STETH) $ 2,482.29 2.99%
dogecoin
Dogecoin (DOGE) $ 0.157432 5.53%
tron
TRON (TRX) $ 0.166575 0.95%
cardano
Cardano (ADA) $ 0.353343 1.01%
the-open-network
Toncoin (TON) $ 4.90 0.68%
wrapped-steth
Wrapped stETH (WSTETH) $ 2,949.94 2.30%
shiba-inu
Shiba Inu (SHIB) $ 0.000017 2.48%
wrapped-bitcoin
Wrapped Bitcoin (WBTC) $ 69,546.63 1.70%
avalanche-2
Avalanche (AVAX) $ 24.24 5.15%
weth
WETH (WETH) $ 2,486.79 3.02%
chainlink
Chainlink (LINK) $ 11.13 3.08%
bitcoin-cash
Bitcoin Cash (BCH) $ 344.71 3.52%
usds
USDS (USDS) $ 0.999542 0.22%
leo-token
LEO Token (LEO) $ 6.08 0.74%
polkadot
Polkadot (DOT) $ 3.85 2.53%
sui
Sui (SUI) $ 1.92 7.16%
litecoin
Litecoin (LTC) $ 70.06 0.69%
near
NEAR Protocol (NEAR) $ 3.88 4.76%
wrapped-eeth
Wrapped eETH (WEETH) $ 2,613.64 2.81%
aptos
Aptos (APT) $ 8.63 6.29%
uniswap
Uniswap (UNI) $ 7.35 7.43%
pepe
Pepe (PEPE) $ 0.000009 6.07%
internet-computer
Internet Computer (ICP) $ 7.74 2.89%
dai
Dai (DAI) $ 0.999987 0.15%
bittensor
Bittensor (TAO) $ 444.04 6.67%
fetch-ai
Artificial Superintelligence Alliance (FET) $ 1.19 7.78%
monero
Monero (XMR) $ 154.88 3.08%
kaspa
Kaspa (KAS) $ 0.112908 5.42%
ethena-usde
Ethena USDe (USDE) $ 1.00 0.08%
stellar
Stellar (XLM) $ 0.09186 2.11%
whitebit
WhiteBIT Coin (WBT) $ 18.95 0.43%
ethereum-classic
Ethereum Classic (ETC) $ 18.12 3.44%
first-digital-usd
First Digital USD (FDUSD) $ 0.99917 0.24%
polygon-ecosystem-token
POL (ex-MATIC) (POL) $ 0.314616 2.76%
blockstack
Stacks (STX) $ 1.59 2.54%
okb
OKB (OKB) $ 37.99 1.39%
dogwifcoin
dogwifhat (WIF) $ 2.16 9.41%
aave
Aave (AAVE) $ 139.39 4.45%
filecoin
Filecoin (FIL) $ 3.43 3.44%
arbitrum
Arbitrum (ARB) $ 0.512115 5.43%
crypto-com-chain
Cronos (CRO) $ 0.072647 2.02%
mantle
Mantle (MNT) $ 0.572635 2.84%
thorchain
THORChain (RUNE) $ 5.52 4.63%