Crypto Wallets Targeted In JavaScript Library Exploit—Cybersecurity Firm

bitcoinistPublished on 2025-12-16Last updated on 2025-12-16

Abstract

A critical vulnerability (CVE-2025-55182) in React Server Components (versions 19.0 to 19.2.0) is being actively exploited to inject malicious code into websites and steal cryptocurrency from connected wallets. The flaw, which allows unauthenticated attackers to execute arbitrary code on affected servers, has led to wallet-draining campaigns across multiple crypto sites. Cybersecurity firm Security Alliance (SEAL) warns that attackers are using the exploit to inject scripts that hijack or redirect transactions by altering user interfaces or swapping addresses. Over 50 organizations have reported compromise attempts, with scanning tools and exploit kits rapidly spreading in underground forums. Patched versions (19.0.1, 19.1.2, 19.2.1) are available, and all affected sites are urged to update immediately.

A critical flaw in React Server Components is being used by attackers to inject malicious code into live websites, and that code is siphoning crypto from connected wallets.

Reports note that the vulnerability, tracked as CVE-2025-55182, was published by the React team on December 3 and carries a maximum severity rating.

Cybersecurity firm Security Alliance (SEAL) has confirmed that multiple crypto websites are actively being targeted, and they urge operators to review all React Server Components immediately to prevent wallet-draining attacks.

Security teams say the bug allows an unauthenticated attacker to run code on affected servers, which has been turned into wallet-draining campaigns across several sites.

Image: Shutterstock

A Wide Risk To Sites Using Server Components

SEAL said the flaw affects React Server Components packages in versions 19.0 through 19.2.0, and patched releases such as 19.0.1, 19.1.2, and 19.2.1 were issued after disclosure.

The vulnerability works by exploiting unsafe deserialization in the Flight protocol, letting a single crafted HTTP request execute arbitrary code with the web server’s privileges. Security teams have warned that many sites using default configurations are at risk until they apply the updates.

Attackers Inject Wallet-Draining Scripts Into Compromised Pages

According to industry posts, threat actors are using the exploit to plant scripts that prompt users to connect Web3 wallets and then hijack or redirect transactions.

In some cases the injected code alters the user interface or swaps addresses, so a user believes they are sending funds to one account while the transaction actually pays an attacker. This method can hit users who trust familiar crypto sites and connect wallets without checking every approval.

BTCUSD now trading at $89,626. Chart: TradingView

Scanners And Proof-Of-Concepts Flooded Underground Forums

Security researchers report a rush of scanning tools, fake proof-of-concept code, and exploit kits shared in underground forums shortly after the vulnerability was disclosed.

Cloud and threat-intelligence teams have observed multiple groups scanning for vulnerable servers and testing payloads, which has accelerated active exploitation.

Some defenders say that the speed and volume of scanning have made it hard to stop all attempts before patches are applied.

More Than 50 Organizations Reported Compromise Attempts

Based on reports from incident responders, post-exploitation crypto activity has been observed at more than 50 organizations across finance, media, government, and tech.

In several investigations, attackers established footholds and then used those to deliver further malware or to seed front-end code that targets wallet users.

SEAL has emphasized that organizations failing to patch or monitor their servers could experience further attacks, and ongoing monitoring is essential until all systems are verified safe.

Featured image from Unsplash, chart from TradingView

Related Reads

Podcast Notes | Conversation with GSR Asset Management Head: To Determine if This Crypto Rally is Real, Just Watch the Lending Rates on Aave

Podcast Summary: Dialogue with GSR's Head of Asset Management: To Determine if This Crypto Rally is Real, Just Check Lending Rates on Aave Andy Baehr, Managing Director of Asset Management at GSR, discusses the current crypto market, characterizing it as stuck in a state of "ambivalence" with short-lived, unsustainable rallies. He outlines a simple framework: the market moves between "ambivalence" and "conviction" (sustained upward momentum). Currently, every rally resembles a single-stage rocket booster that quickly fizzles out. Baehr identifies three key signals to watch: 1) DeFi lending rates, 2) the potential passage of the CLARITY Act, and 3) the market forming a consensus on the "Fed hawkish peak." He emphasizes that the most immediate indicator for the sustainability of the recent CPI-triggered rally is the USDC borrowing rate on Aave, currently around 3.75%—close to U.S. Treasury yields. The absence of a credit spread indicates low leverage demand and a lack of market energy. He explains that a healthy, sustained rally requires layered buying pressure. Last year's rally progressed from an ETH short squeeze to crypto-native trader influx and finally to ETF inflows. Currently, this structure is missing. Other potential structural buyers like Digital Asset Treasury (DAT) companies are absent, and ETF flows have proven transient. Baehr notes that while small-cap crypto tokens outperformed large caps in Q2—a potential sign of capitation in major assets—capital is also flowing to more exciting opportunities like AI stocks and tech IPOs, leaving crypto sidelined. Regarding DeFi, he highlights that platforms like Aave provide a clear, real-time signal of leverage demand through their supply/demand-driven interest rates. A significant, sustained rate increase would signal genuine market conviction. He also observes the quiet emergence of fixed-income-like products and vaults in DeFi. On regulation, the probability of the CLARITY Act passing before the August 7th deadline has dropped linearly from 75% to below 40% on Polymarket. Baehr suggests its passage would be treated as a bullish surprise, a potent driver for price movement. However, political hurdles, including ethical clause debates and disclosures about the First Family's crypto profits, remain significant obstacles. Ultimately, the market awaits clarity on the Fed's terminal rate under Chair Warsh. Until the "Fed Solstice"—the point where the market collectively understands the peak of hawkish policy—sustained conviction will be difficult to achieve.

marsbit5m ago

Podcast Notes | Conversation with GSR Asset Management Head: To Determine if This Crypto Rally is Real, Just Watch the Lending Rates on Aave

marsbit5m ago

Send a Message to Transfer Coins? Telegram to 'Stuff' a Crypto Wallet into 1 Billion Users This Summer

Telegram founder Pavel Durov has announced that a native, non-custodial wallet called Gram wallet will be built into every Telegram app this summer. This move aims to provide instant, fee-free cryptocurrency transfers for the platform's over 1 billion monthly active users. Durov described it as the largest deployment of a non-custodial crypto wallet in history. The new wallet, developed by Telegram itself, differs fundamentally from the existing third-party @wallet bot. It will be non-custodial from the start, meaning users will control their private keys. Following the announcement, the GRAM token (formerly Toncoin) saw a price increase of approximately 8%. This initiative is part of Telegram's renewed control over the TON blockchain and its "Make TON Great Again" roadmap, marking a return to the project after a 2018 SEC lawsuit. The launch comes as other super-apps like X Money and Meta are also expanding into digital payments, with Telegram opting for a crypto-native approach. However, key details remain unclear, including the exact launch date beyond "this summer," how the promised zero fees will be implemented technically, and how asset support and private key management will work for mainstream users.

marsbit48m ago

Send a Message to Transfer Coins? Telegram to 'Stuff' a Crypto Wallet into 1 Billion Users This Summer

marsbit48m ago

Hyperliquid’s HIP-4 proposal fuels HYPE staking as long-term conviction grows

Hyperliquid has proposed the HIP-4 upgrade to expand from perpetual futures into a broader, permissionless infrastructure layer for on-chain applications, requiring deployers to stake 500,000 HYPE to launch new markets. This shift aims to enable developers to build on its platform, a strategy backed by growing long-term investor conviction. Evidence includes a major trader staking millions in HYPE instead of taking profits, with total staked tokens reaching 43.9% of the supply, reducing available tokens and strengthening network security. Market metrics like high open interest and balanced funding rates suggest measured, non-speculative trader positioning. Sustained growth in protocol revenue, TVL, and governance participation further supports the positive outlook, contingent on continued user adoption and successful upgrade execution.

ambcrypto50m ago

Hyperliquid’s HIP-4 proposal fuels HYPE staking as long-term conviction grows

ambcrypto50m ago

7 Months After the Collapse of Huiwang, Southeast Asia's Escrow Platforms Undergo a Major Reshuffle

Following the collapse of Huione Pay—dubbed the "Alipay of Southeast Asia"—seven months ago, the region's underground financial guarantee platform sector is undergoing a significant reshuffle. This power vacuum has been swiftly filled by emerging platforms such as XinBi, Tiger/Navigator, JinBei (renamed JinBo), Dali/Tiancheng, and FullyLight. These platforms, operating largely via Telegram and offering services like escrow for illicit transactions, have absorbed the vast user base and markets left behind by Huione. While positioning themselves as "trust intermediaries," their primary clientele consists of networks involved in online scams, money laundering, illegal gambling, and even human trafficking. For instance, the Tiger/Navigator platform explicitly provides "escrow" services for kidnapping-for-ransom operations ("强押车交易"). Data underscores the immense scale: Huione alone processed over $103 billion in cryptocurrency payments and facilitated over $31 billion through its escrow market before its downfall, linking it to Cambodia's notorious Prince Group. Since its collapse, competitors have seen explosive growth. For example, the XinBi platform has accumulated over $1.6 billion in total USDT revenue, while platforms like NewPay, OkPay (under Dali), and FullyLight Wallet collectively processed over $4.8 billion in USDT in a single year. This ecosystem thrives in regions like Cambodia and Myanmar, where regulatory gaps allow these platforms to act as critical financial infrastructure for sprawling cybercrime industries, from scam compounds to online casinos. The article concludes that the moniker "Southeast Asian Alipay" is a misnomer, obscuring the platforms' fundamental role in enabling serious criminal enterprises rather than representing legitimate financial innovation.

Odaily星球日报1h ago

7 Months After the Collapse of Huiwang, Southeast Asia's Escrow Platforms Undergo a Major Reshuffle

Odaily星球日报1h ago

The Changing Landscape: What Are Crypto VCs Experiencing?

Title: The Shifting Landscape of Crypto Venture Capital The era of dedicated crypto venture capital funds is undergoing a significant transformation. Once essential for navigating the sector's complexity and high risk, these specialized funds are now facing an identity crisis as the market matures. This shift mirrors historical patterns in other specialized investment classes like cleantech and SPACs, where initial information advantages dissipate as technologies become mainstream and integrated into existing industry frameworks. The article argues that crypto is reaching a critical inflection point, transitioning from a "building phase" to an "integration phase." Major players like Stripe, BlackRock, and Visa now engage with crypto not for its novel mechanics but as a foundational financial infrastructure. Their needs—regulatory compliance, banking partnerships, distribution channels—align with traditional fintech, a domain easily understood by large, generalist funds like Sequoia and Founders Fund. This evolution creates a "barbell effect" within the VC landscape. On one end are massive, diversified platforms that can incorporate crypto as one vertical among many. On the other are small, nimble funds focused on niche, experimental projects. The middle ground—medium-sized dedicated crypto funds—is being squeezed out. Their typical fund size makes it impossible to generate sufficient returns solely from early-stage crypto bets, yet they cannot compete with giants for later-stage deals. Consequently, leading crypto-native firms like Paradigm and Framework Ventures are expanding into AI, robotics, and other sectors, driven partly by LP pressure for better returns amid a broader VC DPI crisis. Others, like Dragonfly and a16z, have narrowed their crypto focus predominantly to financial infrastructure like stablecoins, reframing the sector's core narrative. For crypto entrepreneurs, this consolidation presents challenges. While generalist funds offer larger checks and broader resources, crypto projects now compete fiercely with AI for attention and capital within these firms. Furthermore, the long-term, non-commercial foundational work that built the ecosystem—funded by dedicated crypto VCs—is less likely to attract generalist capital focused on direct returns. The conclusion is that "crypto investor" as a standalone category is becoming obsolete, akin to "internet investor." Crypto is becoming a baseline infrastructure layer. The future will see a barbell structure: large-scale growth financing handled by generalist funds, while pioneering, speculative projects are funded by small, specialized vehicles. The dedicated crypto funds of the 2017-2021 boom, which incubated core infrastructure, are giving way to this new, bifurcated reality.

Foresight News1h ago

The Changing Landscape: What Are Crypto VCs Experiencing?

Foresight News1h ago

Trading

Spot
活动图片