Crypto Wallets Targeted In JavaScript Library Exploit—Cybersecurity Firm

bitcoinistPubblicato 2025-12-16Pubblicato ultima volta 2025-12-16

Introduzione

A critical vulnerability (CVE-2025-55182) in React Server Components (versions 19.0 to 19.2.0) is being actively exploited to inject malicious code into websites and steal cryptocurrency from connected wallets. The flaw, which allows unauthenticated attackers to execute arbitrary code on affected servers, has led to wallet-draining campaigns across multiple crypto sites. Cybersecurity firm Security Alliance (SEAL) warns that attackers are using the exploit to inject scripts that hijack or redirect transactions by altering user interfaces or swapping addresses. Over 50 organizations have reported compromise attempts, with scanning tools and exploit kits rapidly spreading in underground forums. Patched versions (19.0.1, 19.1.2, 19.2.1) are available, and all affected sites are urged to update immediately.

A critical flaw in React Server Components is being used by attackers to inject malicious code into live websites, and that code is siphoning crypto from connected wallets.

Reports note that the vulnerability, tracked as CVE-2025-55182, was published by the React team on December 3 and carries a maximum severity rating.

Cybersecurity firm Security Alliance (SEAL) has confirmed that multiple crypto websites are actively being targeted, and they urge operators to review all React Server Components immediately to prevent wallet-draining attacks.

Security teams say the bug allows an unauthenticated attacker to run code on affected servers, which has been turned into wallet-draining campaigns across several sites.

Image: Shutterstock

A Wide Risk To Sites Using Server Components

SEAL said the flaw affects React Server Components packages in versions 19.0 through 19.2.0, and patched releases such as 19.0.1, 19.1.2, and 19.2.1 were issued after disclosure.

The vulnerability works by exploiting unsafe deserialization in the Flight protocol, letting a single crafted HTTP request execute arbitrary code with the web server’s privileges. Security teams have warned that many sites using default configurations are at risk until they apply the updates.

Attackers Inject Wallet-Draining Scripts Into Compromised Pages

According to industry posts, threat actors are using the exploit to plant scripts that prompt users to connect Web3 wallets and then hijack or redirect transactions.

In some cases the injected code alters the user interface or swaps addresses, so a user believes they are sending funds to one account while the transaction actually pays an attacker. This method can hit users who trust familiar crypto sites and connect wallets without checking every approval.

BTCUSD now trading at $89,626. Chart: TradingView

Scanners And Proof-Of-Concepts Flooded Underground Forums

Security researchers report a rush of scanning tools, fake proof-of-concept code, and exploit kits shared in underground forums shortly after the vulnerability was disclosed.

Cloud and threat-intelligence teams have observed multiple groups scanning for vulnerable servers and testing payloads, which has accelerated active exploitation.

Some defenders say that the speed and volume of scanning have made it hard to stop all attempts before patches are applied.

More Than 50 Organizations Reported Compromise Attempts

Based on reports from incident responders, post-exploitation crypto activity has been observed at more than 50 organizations across finance, media, government, and tech.

In several investigations, attackers established footholds and then used those to deliver further malware or to seed front-end code that targets wallet users.

SEAL has emphasized that organizations failing to patch or monitor their servers could experience further attacks, and ongoing monitoring is essential until all systems are verified safe.

Featured image from Unsplash, chart from TradingView

Letture associate

Liberland Fires Tech Secretary After Alleged Blockchain And Website Takeover Attempt

Liberland's congress has voted to remove Technology Secretary Dorian Stern Vukotić, following a resolution accusing him of attempting to hijack the Liberland.org domain, removing administrative multisig protections, blocking the president from voting, and launching unauthorized tokens. The incident serves as a case study in blockchain governance, highlighting risks that go beyond smart contracts to include control over domains, admin keys, and off-chain authority. For the crypto industry, it underscores the need to scrutinize decentralization claims against operational realities, where a small group can still compromise governance. The story reflects a broader market shift where infrastructure security and governance are becoming as critical as price action. Editorial framing should treat the development as a verified information signal about governance risks, avoiding overstatement of Liberland's legal status and leaving room for follow-up evidence.

bitcoinist32 min fa

Liberland Fires Tech Secretary After Alleged Blockchain And Website Takeover Attempt

bitcoinist32 min fa

How to Do Research Well: Deliberately Practice the Real Skills That Matter

No one truly teaches you how to do research. You're often given a desk, a pre-selected problem, and vague instructions to "create something new." Consequently, many people reverse-engineer the job based on visible outputs—papers, posts, announcements—learning only how to *appear* like a researcher rather than how to *become* one. True research capability is built from stacking small, trainable skills, nearly all of which can be developed through deliberate practice. **Pick Your Own Problem:** Most researchers absorb problems from advisors or trends, lacking the underlying reasoning. Choosing a problem you genuinely care about, as John Schulman advises, leads to original work. Develop "taste" like a muscle: predict experiment outcomes, guess paper results from methods, and track which findings remain important over time. **Upgrade Your Inputs:** Relying on shared reading lists (arXiv hot lists, filtered group chats) leads to unoriginal conclusions. Undervalued old literature often holds crucial insights (e.g., MoE, LSTM, backpropagation). Richard Sutton's "The Bitter Lesson" or Claude Shannon's 1952 talk on creative thinking are more predictive than lengthy modern surveys. Breadth matters as much as depth: draw from neuroscience, mechanism design, hardware knowledge, and honest statistics. Read papers directly, especially appendices and limitations sections. **Write Everything Down:** As Paul Graham noted, writing exposes flaws in seemingly mature ideas. Writing is the cheapest defense against self-deception. Following Feynman's principle, Darwin programmatically wrote down facts contradicting his theory to combat memory bias. Maintain a detailed log of hypotheses, setups, predictions, results, and updated understandings. Reviewing past logs fosters essential humility.

marsbit1 h fa

How to Do Research Well: Deliberately Practice the Real Skills That Matter

marsbit1 h fa

Backpack Surges Over 150% in Half a Month

BP, the token of the Backpack exchange, has surged over 150% since early June, driven by the platform's expansion into regulated US stock brokerage and asset tokenization services. On June 2nd, Backpack announced Backpack Securities, offering traditional stock trading and tokenization, causing BP's price to jump over 80%. Momentum continued on June 12th with the launch of SPCX, a tokenized product for SpaceX stock on Solana, facilitating seamless conversion between traditional securities and on-chain assets. This aligns with the RWA (Real World Assets) narrative, creating a bridge between traditional finance and Solana DeFi. The token's unique economics also support its growth. All 2.5 billion initially circulating tokens were airdropped to the community, with zero allocation to the team or investors at launch. A key feature allows users who stake BP for at least one year to gain the right to convert tokens into company equity upon an IPO or acquisition. Despite some initial community controversy over airdrop distribution, focus is shifting to BP's long-term utility and value alignment as real products launch.

marsbit1 h fa

Backpack Surges Over 150% in Half a Month

marsbit1 h fa

Following US Ban on Fable 5, Zhipu AI's Stock Soars 47%

On June 15th, shares of Zhipu AI surged dramatically on the Hong Kong stock market, peaking at a 47.6% gain before closing 32.82% higher. This sharp increase was directly triggered by two recent industry events. On June 12th, Anthropic announced it was suspending global access to its latest flagship models, Claude Fable 5 and Claude Mythos 5, to comply with a U.S. government export control order. The next day, Zhipu AI announced it would open access to its latest open-source flagship model, GLM-5.2, under the permissive MIT license. The Anthropic incident highlighted a critical issue beyond raw model capability: the risk of sudden, unpredictable loss of access to advanced AI models, especially for developers and enterprises deeply integrated with them. This has shifted industry and market focus toward factors like stability, sustainable access, and controllability. Zhipu's move, promoting "frontier intelligence for all," positions its openly available model as a reliable and accessible alternative. The GLM-5.2 model emphasizes "Long Horizon Task" capabilities with a 1M context window, targeting complex, multi-step coding and engineering workflows where maintaining context is crucial. Analysts note this event exposes the risk of dependency on closed-source models subject to single jurisdictional controls, potentially accelerating a shift toward domestic base models and localized deployments. The market's reaction signals a new valuation dimension in AI: providers who can offer stable, long-term, and sustainably accessible AI capabilities are gaining strategic importance.

marsbit2 h fa

Following US Ban on Fable 5, Zhipu AI's Stock Soars 47%

marsbit2 h fa

Fully Entering the AI Era: Alipay Bets on Conversation, WeChat Holds Fast to Social

In May 2026, Alipay announced over 300 million AI payment transactions. Shortly after, WeChat opened its mini-programs for AI integration, sparking controversy by requiring developer source code access. This highlights their diverging approaches to AI integration. Alipay is testing "Project Treasure," an optional AI-native interface replacing traditional app grids with a conversational window. Users can command complex tasks (e.g., "book a ride and order coffee") handled end-to-end by AI. This shift follows an abandoned standalone AI app, focusing instead on enhancing its existing user base. For unmodified mini-programs, Alipay's AI uses "screen-reading" to simulate user interactions, bypassing the need for developer overhaul. It also introduced "Token Pay" for micro-transactions and "AI Wallets" for autonomous agent spending. WeChat, prioritizing its core social function, is taking an embedded approach. Its AI agent will operate within existing contexts like group chats and official accounts, assisting without a separate interface. To enable this, WeChat offers developers two paths: granting source code access for direct AI control ("Automatic Mode") or manually encapsulating services into standardized "Skills." Both place significant burden on developers. Key differences emerge in handling legacy services: WeChat demands developer cooperation (code or labor), while Alipay's screen-reading offers immediate, if potentially less stable, compatibility. Alipay's 3 billion AI transactions demonstrate user acceptance of AI-driven commercial actions. The divergent strategies may reshape mini-program ecosystems—Alipay passively "AI-fying" services, WeChat potentially favoring resource-rich developers—and set competing technical standards. Ultimately, the competition centers on where users entrust the command to "help me get things done."

marsbit2 h fa

Fully Entering the AI Era: Alipay Bets on Conversation, WeChat Holds Fast to Social

marsbit2 h fa

Trading

Spot
Futures
活动图片