Bitget App
Trade smarter
Buy cryptoMarketsTradeFuturesCopyBotsEarn
1inch Frontend Compromised in Widespread Supply Chain Attack 

1inch Frontend Compromised in Widespread Supply Chain Attack 

BeInCryptoBeInCrypto2024/10/30 17:40
By:Mohammad Shahid

1Inch and TEN Finance users are at risk after a malicious supply chain attack on Lottie Player's code. Avoid platform interactions for now.

Decentralized exchange aggregator 1inch’s website has been breached along with multiple other platforms that use the same frontend library, Lottie Player. 

The breach originated from malicious code injected into the Lottie Player, a widely-used animation library used by several dApps and non-crypto websites. As of now, no user wallets have been reportedly compromised.  

1inch Users Cautioned Against Any Interactions

According to several posts on X (formerly Twitter), 1inch and TEN Finance are the confirmed victims of this attack so far. However, the number could be much higher, as the exploit targeted Lottie Player versions 2.0.5 and above. 

Hackers have reportedly injected malicious code into the front-end JSON files of websites using these versions. This code now enables the compromised sites to perform unauthorized transactions, posing a severe threat to users’ assets and data.

Read More: 9 Crypto Wallet Security Tips To Safeguard Your Assets

Reports from Blockaid indicate that the attack was introduced through a compromise of Lottie Player’s content server, where a malicious npm package was used to distribute altered code. Blockaid and other security firms have confirmed the injection of unauthorized scripts within the package.

“Legitimate sites (non crypto as well) are now serving malicious content, including anti-debug evasion code. @LottieFiles, it looks like attackers have managed to push malicious versions of your package, with another version being uploaded now,” Blockaid wrote in an X (formerly Twitter) post

At the time of writing, 1inch hasn’t released any official statement on the breach. However, the Lottie Player team has confirmed that they were able to identify the cause of the breach and are working on removing the affected versions.

Users are strictly advised to avoid connecting wallets or interacting with affected platforms until the security issues are fully resolved.

1inch Frontend Compromised in Widespread Supply Chain Attack  image 0Community post on the 1inch Discord channel

Crypto Hacks Continue To Escalate 

Security breaches have been the most plaguing issue of the crypto industry, and malicious activities continue to grow every year. 

Most recently, hackers reportedly stole $20 million worth of cryptocurrencies from the US government. The funds were also part of the $3.6 billion that the feds seized from the Bitfinex hackers.

Blockchain lender Radiant Capital suffered one of the biggest hacks of this year, losing more than $50 million. The hackers gained control of the firm’s private keys and rapidly drained these assets. 

Read More: Crypto Social Media Scams – How to Stay Safe

However, the investigation and prosecution of these crimes have also intensified. FBT recently arrested the SEC X (formerly Twitter) account hacker. The accused is a 25-year-old Alabama man named Eric Council Jr.

Earlier this year, the Council allegedly hacked the SEC’s X account and posted false news about Bitcoin ETF approvals, which significantly affected the market. Yet, the feds believe Council wasn’t the brains of this operation and they are trying to negotiate a plea deal with him. 

So far, crypto hacks have exceeded $2.1 billion in 2024, with CeFi platforms taking the biggest hits. 

0

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

PoolX: Locked for new tokens.
APR up to 10%. Always on, always get airdrop.
Lock now!

You may also like

Major Cryptocurrency Platform to Airdrop Tokens Gets French Crackdown – What Happens Now?

This is the first regulatory sanction for the platform, which has become especially popular after the US Presidential Elections.

Bitcoinsistemi2024/11/23 11:00

Date Revealed for New Cryptocurrency Laws Reform in the UK

The UK is set to introduce some radical changes to crypto and stablecoin regulation in the new year.

Bitcoinsistemi2024/11/23 11:00

Donald Trump’s Pick for US Treasury Secretary is Announced – Here Are His Cryptocurrency Views

US President-elect Donald Trump's choice for Treasury Secretary has finally been announced.

Bitcoinsistemi2024/11/23 11:00