Crypto Wallets Targeted In JavaScript Library Exploit—Cybersecurity Firm

bitcoinistPublished on 2025-12-16Last updated on 2025-12-16

Abstract

A critical vulnerability (CVE-2025-55182) in React Server Components (versions 19.0 to 19.2.0) is being actively exploited to inject malicious code into websites and steal cryptocurrency from connected wallets. The flaw, which allows unauthenticated attackers to execute arbitrary code on affected servers, has led to wallet-draining campaigns across multiple crypto sites. Cybersecurity firm Security Alliance (SEAL) warns that attackers are using the exploit to inject scripts that hijack or redirect transactions by altering user interfaces or swapping addresses. Over 50 organizations have reported compromise attempts, with scanning tools and exploit kits rapidly spreading in underground forums. Patched versions (19.0.1, 19.1.2, 19.2.1) are available, and all affected sites are urged to update immediately.

A critical flaw in React Server Components is being used by attackers to inject malicious code into live websites, and that code is siphoning crypto from connected wallets.

Reports note that the vulnerability, tracked as CVE-2025-55182, was published by the React team on December 3 and carries a maximum severity rating.

Cybersecurity firm Security Alliance (SEAL) has confirmed that multiple crypto websites are actively being targeted, and they urge operators to review all React Server Components immediately to prevent wallet-draining attacks.

Security teams say the bug allows an unauthenticated attacker to run code on affected servers, which has been turned into wallet-draining campaigns across several sites.

Image: Shutterstock

A Wide Risk To Sites Using Server Components

SEAL said the flaw affects React Server Components packages in versions 19.0 through 19.2.0, and patched releases such as 19.0.1, 19.1.2, and 19.2.1 were issued after disclosure.

The vulnerability works by exploiting unsafe deserialization in the Flight protocol, letting a single crafted HTTP request execute arbitrary code with the web server’s privileges. Security teams have warned that many sites using default configurations are at risk until they apply the updates.

Attackers Inject Wallet-Draining Scripts Into Compromised Pages

According to industry posts, threat actors are using the exploit to plant scripts that prompt users to connect Web3 wallets and then hijack or redirect transactions.

In some cases the injected code alters the user interface or swaps addresses, so a user believes they are sending funds to one account while the transaction actually pays an attacker. This method can hit users who trust familiar crypto sites and connect wallets without checking every approval.

BTCUSD now trading at $89,626. Chart: TradingView

Scanners And Proof-Of-Concepts Flooded Underground Forums

Security researchers report a rush of scanning tools, fake proof-of-concept code, and exploit kits shared in underground forums shortly after the vulnerability was disclosed.

Cloud and threat-intelligence teams have observed multiple groups scanning for vulnerable servers and testing payloads, which has accelerated active exploitation.

Some defenders say that the speed and volume of scanning have made it hard to stop all attempts before patches are applied.

More Than 50 Organizations Reported Compromise Attempts

Based on reports from incident responders, post-exploitation crypto activity has been observed at more than 50 organizations across finance, media, government, and tech.

In several investigations, attackers established footholds and then used those to deliver further malware or to seed front-end code that targets wallet users.

SEAL has emphasized that organizations failing to patch or monitor their servers could experience further attacks, and ongoing monitoring is essential until all systems are verified safe.

Featured image from Unsplash, chart from TradingView

Related Reads

Open-Source Plugin Ignites Underlying AI Model Warfare: Behind Claude-mem's Explosive Popularity Lies Big AI Companies' Best-Kept Profit Secret

The open-source plugin "Claude-mem" has ignited a hidden war in the AI industry by tackling a critical weakness in large language models: their lack of memory. This tool, which exploded in popularity on GitHub, works by locally storing and compressing conversation history, slashing redundant token usage by up to 95%. This directly undercuts the "context tax"—the costly practice of repeatedly sending historical data to the cloud with each new interaction. Its integration with another tool, OpenClaw, enabled users to exploit a pricing loophole, using low-cost personal subscriptions to run high-frequency automated tasks meant for expensive enterprise API plans. In response, Anthropic banned third-party OAuth access, triggering a backlash and even a major service outage. Despite the crackdown, Claude-mem’s founder circumvented traditional monetization by launching a cryptocurrency, $CMEM, on the Solana network. The episode highlights key tensions in the AI industry: the fight over pricing models, the value of local memory control, and the risks of building on proprietary platforms. The battle over AI’s future is being waged in the code.

marsbit49m ago

Open-Source Plugin Ignites Underlying AI Model Warfare: Behind Claude-mem's Explosive Popularity Lies Big AI Companies' Best-Kept Profit Secret

marsbit49m ago

Arthur Hayes' New Article: It's 'No-Trade Zone' Time

Arthur Hayes argues that the current market is in a "no-trade zone," a period of high uncertainty created by two converging forces: the deflationary shock from AI and the inflationary shock from geopolitics. AI agents are rapidly displacing knowledge workers, eroding their incomes and creditworthiness, which will eventually trigger a deflationary financial crisis in consumer credit-dependent Western economies. Simultaneously, the war in the Middle East, particularly the potential disruption to shipping through the Strait of Hormuz, threatens global energy supplies and could force nations to abandon the dollar system. Hayes outlines three main scenarios: 1) A return to normalcy, where the deflationary AI shock remains the primary concern; 2) The "Tehran Toll Booth," where Iran controls the Strait and demands payment in gold or yuan, accelerating the end of dollar hegemony; and 3) "Empire Strikes Back," where the US destroys Iran's capabilities but risks a catastrophic regional war that sends commodity prices soaring. In all but the most extreme scenarios, Hayes posits that the key driver for Bitcoin's price will be the *quantity* of money, not its price (interest rates). He expects that governments, forced to fund wars and stockpile resources, will have to print money, expanding the money supply. This would be bullish for fixed-supply assets like Bitcoin, even if it occurs alongside rising rates. However, he cautions that until this liquidity is explicitly unleashed (e.g., when bond market volatility spikes), the risk/reward for new long positions is poor. His current strategy is to wait for a clear signal of monetary expansion before deploying capital, preferring to hold gold and select crypto assets in the meantime.

marsbit56m ago

Arthur Hayes' New Article: It's 'No-Trade Zone' Time

marsbit56m ago

Netflix Founder Goes to His Most Feared Place

Netflix co-founder Reed Hastings is stepping down as chairman after nearly 30 years with the company, despite Netflix reporting its strongest-ever quarterly results with a 16% revenue increase and 83% surge in net profit. Hastings, who studied AI in the 1980s, has joined the board and donated $50 million to study AI’s impact on society. He now views AI as the biggest threat to Netflix, fearing that AI-generated content could eventually make free platforms like YouTube more appealing than paid services. While Netflix is using AI to improve production efficiency, Hastings is hedging his bets by engaging directly with AI governance, concerned that the rapid pace of AI development could disrupt the entire content industry.

marsbit1h ago

Netflix Founder Goes to His Most Feared Place

marsbit1h ago

US-Based Bitcoin ETFs Post Roughly $1B Inflows In Past Week: Report

US-based spot Bitcoin ETFs recorded significant inflows of approximately $1 billion over the past week, driven by improved market sentiment amid easing geopolitical tensions in the Middle East. On April 17 alone, net inflows reached $663.9 million, marking the fourth consecutive day of positive movement. BlackRock’s IBIT led with $283 million, followed by Fidelity’s FBTC with $163.42 million and Ark 21Shares’ ARKB with $117.9 million. This brings the two-week total net inflows to over $1.78 billion. Despite the increased institutional interest, Bitcoin’s price declined over 2% in 24 hours, trading around $75,664, while ETF holders remain at a loss with an average cost basis of $82,247.

bitcoinist1h ago

US-Based Bitcoin ETFs Post Roughly $1B Inflows In Past Week: Report

bitcoinist1h ago

a16z Founder: In the Agent Era, What Truly Matters Has Changed

Marc Andreessen, co-founder of a16z, argues that the current AI boom is not an overnight success but the culmination of 80 years of research, now delivering practical results. He emphasizes that this era is defined by the convergence of four key capabilities: large language models (LLMs), reasoning, coding, and agents capable of recursive self-improvement. Andreessen describes the agent architecture—combining an LLM with a shell, file system, markdown, and cron/loop—as a fundamental shift beyond chatbots. This structure leverages existing software components, allowing agents to maintain state, introspect, and extend their own functionality. He predicts a move away from traditional GUI and browser-based interactions toward an "agent-first" world where software is primarily operated by bots, not humans, with people simply stating their goals. He draws parallels to the 2000 internet bubble but notes key differences: current AI infrastructure investments are led by cash-rich giants and quickly monetized. He highlights that scaling constraints involve not just GPUs but the entire chip ecosystem. Open source and edge inference are crucial for democratizing knowledge and enabling low-latency, cost-effective applications on local hardware. Finally, Andreessen identifies significant non-technical challenges: potential short-term cybersecurity crises, the need for "proof of human" identity solutions, financial infrastructure for agents, and institutional resistance from sectors like education and healthcare. He cautions that societal adoption will be slower than technological change.

marsbit1h ago

a16z Founder: In the Agent Era, What Truly Matters Has Changed

marsbit1h ago

Trading

Spot
Futures
活动图片