Hackers Target dYdX Cryptocurrency Exchange by Lacing Open-Source Packages with Malware, Leaving Users' Wallets Vulnerable to Theft.
A series of malicious packages published on the npm and PyPI repositories have left users of the popular cryptocurrency exchange dYdX vulnerable to theft. Researchers from security firm Socket discovered that open-source packages containing the malicious code were laced with a function that stole wallet credentials from dYdX developers, backend systems, and in some cases, backdoored devices.
The compromised packages included version 3.4.1 of the @dydxprotocol/v4-client-js package on npm and the dydx-v4-client package on PyPI. The malware embedded a malicious function that exfiltrated wallet seed phrases, device fingerprints, and other sensitive information, allowing attackers to correlate stolen credentials across multiple compromises.
The malicious code also contained a remote access Trojan (RAT) that enabled execution of new malware on infected systems. Once installed, the RAT allowed attackers to execute arbitrary Python code with user privileges, steal SSH keys and API credentials, install persistent backdoors, exfiltrate sensitive files, monitor user activity, modify critical files, and pivot to other systems on the network.
This is at least the third time dYdX has been targeted by thieves. Previous incidents include a September 2022 uploading of malicious code to the npm repository and a 2024 DNS hijacking incident that commandedeered the dYdX v3 website through DNS spoofing, prompting users to sign transactions designed to drain their wallets.
The security firm warned users to carefully examine all apps for dependencies on the malicious packages listed above. "Viewed alongside the 2022 npm supply chain compromise and the 2024 DNS hijacking incident, this latest attack highlights a persistent pattern of adversaries targeting dYdX-related assets through trusted distribution channels," Socket said.
As a result, users are advised to take immediate action to protect themselves from potential theft, including:
* Reviewing all apps for dependencies on the malicious packages listed above
* Updating dependencies to version 1.0.31 or lower on npm and to 1.1.5post1 on PyPI
* Running security scans on devices and systems using dYdX-related assets
* Implementing additional security measures, such as multi-factor authentication and encryption
A series of malicious packages published on the npm and PyPI repositories have left users of the popular cryptocurrency exchange dYdX vulnerable to theft. Researchers from security firm Socket discovered that open-source packages containing the malicious code were laced with a function that stole wallet credentials from dYdX developers, backend systems, and in some cases, backdoored devices.
The compromised packages included version 3.4.1 of the @dydxprotocol/v4-client-js package on npm and the dydx-v4-client package on PyPI. The malware embedded a malicious function that exfiltrated wallet seed phrases, device fingerprints, and other sensitive information, allowing attackers to correlate stolen credentials across multiple compromises.
The malicious code also contained a remote access Trojan (RAT) that enabled execution of new malware on infected systems. Once installed, the RAT allowed attackers to execute arbitrary Python code with user privileges, steal SSH keys and API credentials, install persistent backdoors, exfiltrate sensitive files, monitor user activity, modify critical files, and pivot to other systems on the network.
This is at least the third time dYdX has been targeted by thieves. Previous incidents include a September 2022 uploading of malicious code to the npm repository and a 2024 DNS hijacking incident that commandedeered the dYdX v3 website through DNS spoofing, prompting users to sign transactions designed to drain their wallets.
The security firm warned users to carefully examine all apps for dependencies on the malicious packages listed above. "Viewed alongside the 2022 npm supply chain compromise and the 2024 DNS hijacking incident, this latest attack highlights a persistent pattern of adversaries targeting dYdX-related assets through trusted distribution channels," Socket said.
As a result, users are advised to take immediate action to protect themselves from potential theft, including:
* Reviewing all apps for dependencies on the malicious packages listed above
* Updating dependencies to version 1.0.31 or lower on npm and to 1.1.5post1 on PyPI
* Running security scans on devices and systems using dYdX-related assets
* Implementing additional security measures, such as multi-factor authentication and encryption
. Can't these devs just take the time to review their dependencies for once? I mean, come on, npm and PyPI are supposed to be reputable channels... how hard is it to check a few versions? This dYdX thing has been targeted before, like 2022 and 2024 already 
. It's getting old, hackers just keep coming back and exploiting the same weaknesses. Wallets left vulnerable, device fingerprints stolen... what's next? 
dYdX users r in trouble again! 
hackers laced open-source packages with malware 
it's like they think no one's watching 
these malicious packages stole wallet credentials & backdoored devices 
need to keep a close eye on our apps & updates 
1.0.31 or lower is key 
don't wanna get phishing'd 
gotta stay safe online 
? But seriously, I feel bad for the users. It's like they're just trying to make some quick cash and then BAM! Hackers are stealing their seed phrases and running off with it 
.
.
But, seriously, dYdX needs to step up their game and improve their security measures ASAP. It's just not worth the risk of losing all your crypto funds 
"update your dependencies" yadda yadda... like who's got the time or expertise to do that? 
shouldn't we be expecting better from a reputable exchange like dYdX?!
. But seriously, it's so frustrating when companies don't take security seriously enough. This is the third time this year that dYdX has been hit, and it's just not acceptable 
.
. And what's with all these dependencies? It's like they're just a breeding ground for malware 
. I'm literally shaking my head at this. The security firm is right, though - it is a pattern of hackers targeting dYdX through trusted channels. We need to start holding companies accountable for their security measures 
. But seriously, dYdX needs to step up its game when it comes to security 
. This isn't just about preventing theft - it's about protecting user data and trust 
.
. I hope dYdX devs are on top of it and fix this ASAP 
. They've had two other incidents already in 2022 and 2024. It's like, what are they doing wrong? 
. And even then, who knows if it'll keep them safe? 
. Can we please get some better security measures in place already? 
then update them ASAP or risk being hacked too 
. It's just so frustrating when these kinds of things happen