Lottie Player Crypto Hack: Major DApps Attacked, Users Lose $720K
Qadir AK31 Oct 20242 min read
This comes as a major shock to the crypto industry.
In a major coordinated attack on the web3 space, on-chain sleuths discovered a massive supply chain attack on Lottie Player earlier today. The LottieFiles team reported that attackers injected malicious code into several versions of Lottie Player, including 2.05, 2.06, and 2.0.7, which were published on GitHub’s npm platform.
“The unauthorized versions contained code that prompted for connecting to user’s crypto wallets. A large number of users using the library via third-party CDNs without a pinned version were automatically served the compromised version as the latest release,” the LottieFiles team noted.
Users at Risk? Here’s What Was Done
The LottieFiles team is currently investigating the incident, suspecting that a developer with the necessary privileges facilitated the attack. They have since released a new secure version, called 2.0.8, which is a copy of the original Lottie Player version 2.0.4.
To prevent further harm, the LottieFiles team has unpublished the compromised package versions from the npm platform. They also removed all access and associated service accounts of the impacted developer.
Impact of the Lottie Player Supply Chain Attack
According to the on-chain analysis platform Scam Sniffer, the Lottie Player supply chain attack affected major decentralized applications (DApps), including 1inch (1INCH) and Movement Network. The attackers aimed to drain users’ funds, prompting the 1inch protocol to pledge refunds to all affected users through its network.
In response to the attack, the 1inch team has urged all impacted users to revoke ERC20 smart contract approvals from malicious addresses using revoke.cash to avoid further losses. On-chain data analysis revealed that a web3 user lost 10 Bitcoins, worth over $720,000, earlier today due to the Lottie Player supply chain attack.
As the dust settles on this attack, one question remains: What’s next for the web3 world?
