Bitget App
Trade smarter
Buy cryptoMarketsTradeFuturesEarnWeb3SquareMore
Trade
Spot
Buy and sell crypto with ease
Margin
Amplify your capital and maximize fund efficiency
Onchain
Going Onchain, without going Onchain!
Convert
Zero fees, no slippage
Explore
Launchhub
Gain the edge early and start winning
Copy
Copy elite trader with one click
Bots
Simple, fast, and reliable AI trading bot
Trade
USDT-M Futures
Futures settled in USDT
USDC-M Futures
Futures settled in USDC
Coin-M Futures
Futures settled in cryptocurrencies
Explore
Futures guide
A beginner-to-advanced journey in futures trading
Futures promotions
Generous rewards await
Overview
A variety of products to grow your assets
Simple Earn
Deposit and withdraw anytime to earn flexible returns with zero risk
On-chain Earn
Earn profits daily without risking principal
Structured Earn
Robust financial innovation to navigate market swings
VIP and Wealth Management
Premium services for smart wealth management
Loans
Flexible borrowing with high fund security
Crypto Stealing Solana Trading Bot on GitHub Exposed

Crypto Stealing Solana Trading Bot on GitHub Exposed

2025/07/05 00:15
By:

A GitHub page pretending to be a real Solana trading bot was found to be hiding malware that steals crypto. The page was created by a user named “zldp2002” and looked like a real open-source tool. But when users ran it, their crypto got stolen.

The problem came to light after someone lost their funds. Blockchain security firm SlowMist looked into it and found the bot used strange coding patterns and had many fake stars and forks on GitHub to look trustworthy. For further context, all the code was uploaded around three weeks ago.

SlowMist found that the trading bot was built using Node.js and included a package named crypto-layout-utils. This package was already removed from the official Node.js (NPM) registry. Instead of using the official source, the attacker had users download it from a different GitHub page. This raised further suspicion.

When SlowMist experts scanned the package, they detected that it was highly obfuscated (made difficult on purpose) via a jsjiami.com webpage. Upon decoding, they discovered that the package scanned users’ local files. If it detected any wallet-related information or private keys, it would silently send the information to a remote server operated by the attacker.

The analysis also indicated that this was not the only malicious project. The hacker probably had multiple GitHub accounts for publishing similar spoofed projects. These projects were copied (forked) from actual ones and slightly modified to contain malware. Some used another malicious package named bs58-encrypt-utils-1.0.3, which was first introduced on June 12.

This case is part of a larger wave of cyberattacks on crypto users. Recently, hackers also targeted Firefox users with fake wallet extensions and used GitHub to spread harmful code.

0

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

PoolX: Earn new token airdrops
Lock your assets and earn 10%+ APR
Lock now!

You may also like

KMNO - -90.86% 24H Drop Amid Volatile Market Conditions

- KMNO plummeted 90.86% in 24 hours to $0.05827, reflecting intense liquidity pressure and shifting market sentiment. - A 563.27% drop over seven days and 946.12% annual decline highlight structural market shifts and macroeconomic headwinds. - A 1102.57% monthly surge drew investors, but bearish momentum persisted, prompting a backtesting strategy using moving averages and RSI for trade opportunities. - Technical indicators confirmed oversold conditions, with key support levels unrecaptured, reinforcing ca

ainvest2025/08/29 02:13
KMNO - -90.86% 24H Drop Amid Volatile Market Conditions

Solana News Today: Institutional Money Moves to Solana—What Does It Mean for Crypto’s Future?

- Solana outpaces Ethereum in DEX volume, driven by institutional investments and network upgrades like Alpenglow. - Institutional holdings of $1.72B and 6.86% staking yield signal growing confidence in Solana's long-term potential. - Solana's 17% price surge vs. Ethereum's 6% reflects its appeal for high-throughput DeFi/NFTs, though Ethereum retains Layer 2 liquidity advantages. - Upcoming upgrades aim to boost Solana's throughput, while Ethereum targets 10M TPS via Layer 2 scaling to maintain institution

ainvest2025/08/29 02:12
Solana News Today: Institutional Money Moves to Solana—What Does It Mean for Crypto’s Future?

LPT +1582.54% in 7 Days as Short-Term Gains Overshadow Long-Term Decline

- LPT surged 1582.54% in 7 days but fell 4914.14% over 1 year, showing extreme short-term volatility vs. long-term decline. - Analysts attribute the rebound to market rotation and speculative trading rather than fundamental improvements in the token's value. - Technical indicators suggest short-term exhaustion near $6.552, with moving averages and RSI signaling potential mean reversion after sharp swings. - A backtesting strategy using 50/200-period MA crossovers and RSI/OBV aims to capture short-term reve

ainvest2025/08/29 01:58
LPT +1582.54% in 7 Days as Short-Term Gains Overshadow Long-Term Decline

Bitcoin News Today: Bitcoin's Payment Potential Gains Strategic Support from Block's Dorsey

- Jack Dorsey, Block founder, advocates Bitcoin as a payment tool for small businesses and daily transactions, aligning with Block’s fintech integration strategy. - Block enables Bitcoin payments via Square and Afterpay, reducing adoption friction through user-friendly tools and merchant support. - Market challenges like Bitcoin’s volatility and Ethereum capital shifts persist, but decentralized benefits drive adoption despite risks. - Google Cloud and MoonPay expand crypto infrastructure, while U.S. crypt

ainvest2025/08/29 01:57
Bitcoin News Today: Bitcoin's Payment Potential Gains Strategic Support from Block's Dorsey