Backdoor in Compromised Solana Code Library Drains $184,000 from Digital Wallets

The Solana JavaScript SDK 'was temporarily compromised yesterday in a supply chain attack,' reports BleepingComputer, 'with the library backdoored with malicious code to steal cryptocurrency private keys and drain wallets.'

Solana offers an SDK called '@solana/web3.js' used by decentralized applications (dApps) to connect and interact with the Solana blockchain. Supply chain security firm Socket reports that Solana's Web3.js library was hijacked to push out two malicious versions to steal private and secret cryptography keys to secure wallets and sign transactions... Solana confirmed the breach, stating that one of their publish-access accounts was compromised, allowing the attackers to publish two malicious versions of the library... Solana is warning developers who suspect they were compromised to immediately upgrade to the latest v1.95.8 release and to rotate any keys, including multisigs, program authorities, and server keypairs...

Once the threat actors gain access to these keys, they can load them into their own wallets and remotely drain all stored cryptocurrency and NFTs... Socket says the attack has been traced to the FnvLGtucz4E1ppJHRTev6Qv4X7g8Pw6WPStHCcbAKbfx Solana address, which currently contains 674.86 Solana and varying amounts of the Irish Pepe, Star Atlas, Jupiter, USD Coin, Santa Hat, Pepe on Fire, Bonk, catwifhat, and Genopets Ki tokens. Solscan shows that the estimated value of the stolen cryptocurrency is $184,000 at the time of this writing.

For anyone whose wallets were compromised in this supply chain attack, you should immediately transfer any remaining funds to a new wallet and discontinue the use of the old one as the private keys are now compromised.

Ars Technica adds that 'In social media posts, one person claimed to have lost $20,000 in the hack.'
The compromised library 'receives more than ~350,000 weekly downloads on npm,' Socket posted. (Although Solana's statement says the compromised versions 'were caught within hours and have since been unpublished.'

Read more of this story at Slashdot.