China-Based Hacker Group Steals $7M in Crypto via Wallet Supply Chain Attacks

TheNewsCryptoPublished on 2026-03-18Last updated on 2026-03-18

Abstract

A Chinese hacker group operating under the name Wuhan Anshun Technology has been accused of stealing approximately $7 million in cryptocurrency through supply-chain attacks targeting users of wallets like Trust Wallet. The group used malicious browser extensions and compromised Electron-based apps to collect wallet information and transfer funds, primarily on Ethereum, BNB Chain, and Arbitrum. Details emerged after an internal member leaked information due to disputes over profit sharing, releasing evidence and expressing intent to surrender to authorities. While the case remains unconfirmed by officials, it highlights significant security risks in crypto software. Experts advise caution when updating or installing wallet-related tools.

A Chinese hacker collective has been charged with stealing about $7 million in cryptocurrency by using supply-chain attacks to target users of cryptocurrency wallets. According to reports, the group claimed to be a security services provider while operating under the name Wuhan Anshun Technology. On the other hand, members were allegedly conducting illicit operations to pilfer cryptocurrency assets. Wallets like Trust Wallet and other platforms are thought to have been targeted by the attackers.

How the Group works

The group works by using malicious browser extensions and compromised Electron-based apps with remote access tools. They helped collect wallet information and transfer funds. It mainly targeted blockchains such as Ethereum, BNB Chain, and Arbitrum.

The details of the operation came out after a member of the group leaked information. The person claimed there was a disagreement over profit sharing and unpaid compensation. After the disagreement, the individual reportedly released evidence of the operation and said they plan to surrender to authorities. Authorities have not officially confirmed the case, and no formal investigation details have been released so far.

This incident demonstrates that the software and tools used with the wallets are also risky. Experts advise exercising caution when updating software and refraining from installing unknown updates. The case highlights growing risks in crypto security, even though the claims have not yet been verified.

Highlighted Crypto News:

Juliana Stratton Defeats Crypto-Backed Krishnamoorthi in Illinois Senate Primary

TagsBlockchainchinaCryptocurrency

Related Questions

QWhat is the name of the Chinese hacker group accused of stealing $7 million in cryptocurrency?

AThe group operated under the name Wuhan Anshun Technology.

QHow did the hacker group primarily carry out their attacks to steal cryptocurrency?

AThey used malicious browser extensions and compromised Electron-based apps with remote access tools.

QWhich specific blockchains were the main targets of this hacking group's attacks?

AThe group mainly targeted Ethereum, BNB Chain, and Arbitrum.

QWhat event led to the public disclosure of the group's operation details?

AA member of the group leaked information due to a disagreement over profit sharing and unpaid compensation.

QWhat precautionary advice do experts give in light of this incident?

AExperts advise exercising caution when updating software and refraining from installing unknown updates.

Related Reads

Agent Race Ends, Super Workbench Takes Over

The era of fragmented AI agents is ending. Over the past month, China's tech giants—Tencent, Alibaba, and ByteDance—have simultaneously shifted strategy: instead of launching new, standalone AI agents, they are consolidating their various agent projects into unified "super workbenches." Tencent integrated its QClaw teams into WorkBuddy, a strategic product hailed as a potential third flagship after QQ and WeChat. Alibaba is merging its QoderWork, Wukong, and MuleRun agents into a new "Qianwen Office" platform under DingTalk's leadership. ByteDance rebranded its TRAE SOLO coding agent to TRAE Work, signaling a broader focus on workflow collaboration. This convergence marks a pivotal industry consensus. The initial exploration phase, where companies rapidly built numerous overlapping agents for different scenarios, proved costly and inefficient. With open-source tools eroding technical barriers, competition has shifted from agent creation to resource consolidation and cost control. Historically, platform wars are won not by creating more products, but by simplifying them—as seen with browsers unifying web access and super-apps consolidating services. Now, the "super workbench" aims to become the unified AI entry point for work. This reflects a deeper market realization: the primary audience for AI is no longer just programmers (a market in the tens of millions) but all knowledge workers (a market of billions). The real opportunity lies in augmenting everyday tasks—managing emails, documents, data, and meetings—across the entire workday. The core battleground is becoming control over the primary AI entry point that employees use daily. Tencent's WorkBuddy leverages WeChat and Tencent Docs; Alibaba's Qianwen Office taps into DingTalk's organizational data; ByteDance's TRAE Work integrates with Feishu's workflows. Whoever owns this "super workbench" gains strategic control over orchestrating enterprise data and APIs. This shift is redefining enterprise software. Traditional SaaS applications, valued for their user interfaces, will recede into the background. Their core functionalities will be exposed as standardized "Skills" or APIs for the super workbench's agents to invoke. Software value will shift from selling user seats to charging based on API calls and outcomes delivered. The evolution of agents is moving through clear stages: first as novel standalone products, then as consolidated primary work entry points, and finally as pervasive, invisible capabilities embedded into the digital fabric. The recent moves by major tech firms signal the transition from the first stage into the second, accelerating toward the third. In the end, the most successful agent technology may become invisible—like electricity or the HTTP protocol—a fundamental, unnamed infrastructure powering work itself.

marsbit8m ago

Agent Race Ends, Super Workbench Takes Over

marsbit8m ago

Michael Saylor: 110 Reasons to Oppose BIP-110

Michael Saylor presents 110 arguments against Bitcoin Improvement Proposal (BIP) 110, a soft fork aimed at restricting certain non-monetary data storage uses (like inscriptions) on the Bitcoin blockchain. He acknowledges the proponents' valid concerns—such as node costs, fee pressure, and preserving Bitcoin's monetary focus—but fundamentally disagrees with the proposed solution. Saylor argues that BIP 110 represents a dangerous precedent of using consensus rules to enforce value judgments on transaction validity, moving away from Bitcoin's core principles of neutrality and permissionless innovation. His key objections are organized into eleven categories: 1) It violates neutrality and hard consensus by banning currently valid transactions. 2) It fails to meet the high burden of proof required for a consensus change, lacking concrete data on the alleged crisis. 3) Its seven bundled technical restrictions are overly broad, targeting generic script functionalities and blocking future upgrade paths. 4) It sacrifices compatibility and future optionality by closing off designed upgrade hooks. 5) Its temporary rules add significant complexity (grandfathering, expiry states) without sufficient justification. 6) The economic and security impacts, particularly on miner revenue and fee markets, are uncertain and unmodeled. 7) Superior, market-based tools (fee markets, relay/mining policies) already exist to manage blockchain load. 8) It stifles innovation by creating a chilling effect for developers. 9) Its modified activation mechanism (55% threshold, forced signaling) is aggressive and risks network splits. 10) The precedent it sets—using consensus to suppress disliked but legal uses—is more dangerous than the problem it aims to solve. 11) A better path exists: improving measurements, refining resource-based policies, and allowing market forces to work. Saylor concludes that Bitcoin's strength lies in its neutral rules, open markets, and hard consensus. Changing these foundational elements to target specific use cases is an unnecessary and risky "iatrogenic" intervention. He advocates for guarding Bitcoin's neutrality rather than acting as its redeemer.

marsbit23m ago

Michael Saylor: 110 Reasons to Oppose BIP-110

marsbit23m ago

United Stables Crosses $1B As Chainlink Data Feeds Secure U Token Collateral

United Stables' U token has surpassed $1 billion in market capitalization, with Chainlink Data Feeds providing the critical pricing and collateral data infrastructure across its deployment chains. This milestone highlights that robust oracle infrastructure is essential for stablecoin credibility, as DeFi protocols require reliable data for integration. Chainlink's role is foundational, enabling automated collateral auditing and pricing verification, which helps make the U token safer for the broader market to evaluate and use. While this strengthens Chainlink's position in the stablecoin infrastructure narrative, it does not directly guarantee increased fees or value for LINK token holders. The growth of U indicates both widening competition in the stablecoin sector and the increasing dependence of scalable stablecoins on dependable external data services.

bitcoinist1h ago

United Stables Crosses $1B As Chainlink Data Feeds Secure U Token Collateral

bitcoinist1h ago

BonkDAO Treasury Drain Shows Solana Governance Risk Is Real

The BonkDAO treasury suffered an approximately $20 million drain due to a malicious governance proposal passed through the Realms platform on Solana. This incident highlights governance as a critical attack surface for DAOs, distinct from smart contract exploits. The attack leveraged the DAO's own voting mechanics to move funds, demonstrating that flawed governance design—such as weak proposal rules or voter weight calculations—can be exploited even when the underlying blockchain functions correctly. The event serves as a warning for Solana DAOs to rigorously review and strengthen their governance safeguards, including quorum thresholds, timelocks, and execution permissions. While damaging to community trust, especially for the prominent BONK meme ecosystem, the issue is not a failure of the Solana base layer but a widespread application-level risk common across blockchain ecosystems.

bitcoinist1h ago

BonkDAO Treasury Drain Shows Solana Governance Risk Is Real

bitcoinist1h ago

Midnight Token Falls After $13M Wanchain Bridge Exploit

Midnight's NIGHT token plummeted roughly 30% following a $13.2 million exploit on a Wanchain cross-chain bridge. The attacker drained 515 million NIGHT tokens by exploiting a signature reuse flaw in the bridge's infrastructure, not the core Cardano or Midnight networks. This incident highlights the persistent vulnerability of cross-chain bridges, which are critical for asset transfers but introduce complex security risks. While the underlying blockchains remained secure, the token's price suffered due to liquidity disruption and lost market confidence. The response from Wanchain, including pausing the affected bridge and providing clear communication on recovery efforts, will be crucial for stabilizing the situation. The event serves as a reminder for traders to factor in bridge-related risks when evaluating tokens reliant on cross-chain liquidity.

bitcoinist2h ago

Midnight Token Falls After $13M Wanchain Bridge Exploit

bitcoinist2h ago

Trading

Spot
活动图片