Hackers are exploiting a JavaScript library to plant crypto drainers

cointelegraphОпубликовано 2025-12-15Обновлено 2025-12-15

Введение

A recent surge in crypto drainer attacks is exploiting a critical vulnerability (CVE-2025-55182) in the React JavaScript library, as reported by cybersecurity nonprofit Security Alliance (SEAL). The vulnerability, which allows unauthenticated remote code execution, was disclosed on December 3 after being discovered by a white hat hacker. Attackers are using this flaw to inject wallet-draining code into legitimate crypto websites, often tricking users into signing malicious transactions through fake pop-ups or reward offers. SEAL warns that affected websites may be flagged as phishing risks and urges all site owners to immediately scan their front-end code for suspicious or obfuscated scripts, unrecognized assets, and incorrect recipient addresses in signature requests. The React team has released a patch for the vulnerability and recommends that users of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack upgrade immediately. Apps not using React Server Components or a server are not affected.

There has been a recent uptick in crypto drainers being uploaded to websites through a vulnerability in the open-source front-end JavaScript library React, according to cybersecurity nonprofit Security Alliance (SEAL).

React is used for building user interfaces, especially in web applications. The React team disclosed on Dec. 3 that a white hat hacker, Lachlan Davidson, found a security vulnerability in its software that allowed unauthenticated remote code execution, which can allow an attacker to insert and run their own code.

According to SEAL, bad actors have been using the vulnerability, CVE-2025-55182, to secretly add wallet-draining code to crypto websites.

“We are observing a big uptick in drainers uploaded to legitimate crypto websites through exploitation of the recent React CVE. All websites should review front-end code for any suspicious assets NOW,” the SEAL Team said.

“The attack is targeting not only Web3 protocols! All websites are at risk. Users should exercise caution when signing ANY permit signature.”

Wallet drainers typically dupe users into signing a transaction through methods such as a sham pop-up offering rewards or similar tactics.

Source: Security Alliance

Websites with phishing warning should check code

Affected websites may have been suddenly flagged as a possible phishing risk without explanation, according to the SEAL Team. They recommend website hosts take precautions to ensure there are no hidden drainers that could put users at risk.

“Scan host for CVE-2025-55182. Check if your front-end code is suddenly loading assets from hosts you do not recognize. Check if any of the scripts loaded by your front end code are obfuscated JavaScript. Inspect if the wallet is showing the correct recipient on the signature signing request,” they said.

Related: North Korean ‘fake Zoom’ crypto hacks now a daily threat: SEAL

“If your project is getting blocked, that may be the reason. Please review your code first before requesting phishing page warning removal,” the SEAL Team added.

React has released a fix for the vulnerability

The React team published a fix for CVE-2025-55182 on Dec. 3 and advises anyone using the react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack, to upgrade immediately and close the vulnerability.

“If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability,” the team added.

Magazine: Meet the onchain crypto detectives fighting crime better than the cops

Похожее

Key Lawmaker 'Relents', Wash's Biggest Obstacle to Assuming Fed Chair on May 15 Cleared

Key political opposition to Kevin Warsh's nomination as Federal Reserve Chair has been removed after Senator Thom Tillis (R-N.C.) withdrew his objection, clearing the way for a committee vote on April 29. Tillis had previously blocked the nomination due to a criminal investigation into current Chair Jerome Powell, which he viewed as a threat to Fed independence. The Justice Department has since dropped the investigation. Warsh, who has broad Republican support, is expected to be confirmed by the Senate in time for Powell’s term expiration on May 15. If confirmed, Warsh has signaled significant policy changes, including abolishing the "dot plot" of interest rate projections and reevaluating the Fed’s forward guidance framework. These changes could fundamentally alter the market’s pricing mechanisms for stocks, bonds, and currencies. Although the criminal case against Powell is closed, uncertainty remains as he retains his board seat until 2028. President Trump has not fully endorsed Powell, citing an ongoing review of Fed renovation spending. Warsh’s potential reforms target the communication tools developed post-2008, which have become foundational to global asset pricing.

marsbit20 мин. назад

Key Lawmaker 'Relents', Wash's Biggest Obstacle to Assuming Fed Chair on May 15 Cleared

marsbit20 мин. назад

Lowering Expectations for BTC's Next Bull Market

The author, Alex Xu, explains his decision to significantly reduce his Bitcoin holdings (from full to ~30% of his portfolio) during the current bull cycle, citing a lowered long-term outlook for BTC's price appreciation in the next cycle. He outlines six key reasons for this reduced expectation: 1. **Diminished Growth Drivers:** The narrative of exponential user adoption has largely played out with institutional ETF adoption. The next major growth phase—adoption by sovereign national reserves or central banks—seems unlikely in the near future. 2. **Personal Opportunity Cost:** More attractive investment opportunities have emerged in other assets, such as undervalued companies. 3. **Industry-Wide Contraction:** The broader crypto industry is struggling, with most Web3 business models (SocialFi, GameFi, DePIN) failing. This overall萧条 (depression) reduces the fundamental demand and consensus for Bitcoin. 4. **Strain on Major Buyer:** MicroStrategy, a major corporate buyer of BTC, faces rising financing expenses for its debt, which could slow its purchasing rate and create significant marginal pressure on the market. 5. **Increased Competition from Gold:** The emergence of "tokenized gold" has closed the functional gap (portability, divisibility) between physical gold and Bitcoin, offering a strong competitor in the non-sovereign store-of-value space. 6. **Security Budget Concerns:** The block reward halving continues to exacerbate the long-standing issue of funding Bitcoin's network security, with new fee source explorations like Ordinals and L2s largely failing. The author's decision to hold a significant (though reduced) position reflects a cautious, not bearish, outlook. He remains open to increasing his exposure if the fundamental reasons for his skepticism change or if new positive catalysts emerge.

marsbit35 мин. назад

Lowering Expectations for BTC's Next Bull Market

marsbit35 мин. назад

Prediction Markets Cannot Exist Without Insider Trading, But Insider Trading Is Killing Them

Prediction markets face a fundamental contradiction: they rely on insider trading to generate accurate prices, yet this same activity erodes public trust and threatens their survival. Recent scandals, such as a U.S. special forces member making $400,000 on Polymarket using classified information about a raid, highlight the severity of the issue. While platforms like Polymarket and Kalshi market themselves as venues where "everyone is an expert" and encourage informed trading, they also enforce policies against illegal insider trading. The core dilemma is that these markets depend on informed insiders for price efficiency but require uninformed retail participants to provide liquidity. If insider trading is too rampant, retail traders leave, perceiving the market as unfair. If restrictions are too strict, valuable information flow dries up, reducing the market’s predictive utility. The challenge is finding a balance that maintains both accuracy and perceived fairness—a task complicated by regulatory pressures and recurring scandals.

marsbit40 мин. назад

Prediction Markets Cannot Exist Without Insider Trading, But Insider Trading Is Killing Them

marsbit40 мин. назад

Can Iran 'Control' the Strait of Hormuz?

Iran has announced a comprehensive plan to assert control over the strategic Strait of Hormuz, a critical global oil shipping chokepoint. The proposed measures include requiring all vessels to obtain Iranian permission for passage, imposing fees for security, environmental protection, and navigation management—preferably paid in Iranian rials—and absolutely banning Israeli ships. Vessels from countries deemed hostile by Iran’s top security bodies may also be barred. Analysts suggest Iran’s motives are multifaceted: increasing pressure on the U.S. and Israel by leveraging control over oil transit to influence global prices and inflation; creating a new revenue stream, potentially exceeding $7.7 billion annually, to counter Western sanctions and support postwar reconstruction; and using transit permissions as bargaining chips in future negotiations, notably with the U.S. However, the plan faces significant practical and diplomatic challenges. Enforcing comprehensive interception and fee collection in the busy waterway, patrolled by international military forces, would be difficult. The U.S. has already countering with a blockade of Iranian ports and threats to intercept any ship paying fees, potentially strangling Iran’s oil exports and fee revenue. Broad international opposition, led by European and Gulf states, and legal controversies further complicate implementation. The proposal may ultimately serve more as a negotiating tactic than a feasible policy, with its execution remaining highly uncertain.

marsbit1 ч. назад

Can Iran 'Control' the Strait of Hormuz?

marsbit1 ч. назад

Vertically Integrated Capital Aggregators: How Does Web3 Build an Impregnable Moat?

"Vertical Integration Capital Aggregators: How Web3 Builds Unbreachable Moats" explores how leading Web3 protocols create competitive advantages by vertically integrating multiple ecosystem components. Unlike Web2 aggregators that focus on user demand or supplier commoditization, successful Web3 entities like Hyperliquid aggregate capital, liquidity, users, and distribution into a unified financial ecosystem. This integration allows for efficient capital deployment—Hyperliquid generates $0.30 in fees per $1 of TVL annually, compared to Aave's $0.05—while creating a defensible moat that is difficult to replicate across six simultaneous fronts. However, this model comes with risks: DeFi loses $0.50 to hacks for every $1 earned, pushing protocols toward partial centralization and closed systems for security and scalability. The token serves as a shared incentive layer, aligning stakeholders and driving value through mechanisms like buybacks. The article concludes that vertical integration, not capital itself, is the true moat, and that the industry is evolving toward pragmatic, partially centralized models to ensure economic growth and sustainability.

marsbit2 ч. назад

Vertically Integrated Capital Aggregators: How Does Web3 Build an Impregnable Moat?

marsbit2 ч. назад

Торговля

Спот
Фьючерсы

Популярные статьи

Как купить USDS

Добро пожаловать на HTX.com! Мы сделали приобретение USDS (USDS) простым и удобным. Следуйте нашему пошаговому руководству и отправляйтесь в свое крипто-путешествие.Шаг 1: Создайте аккаунт на HTXИспользуйте свой адрес электронной почты или номер телефона, чтобы зарегистрироваться и бесплатно создать аккаунт на HTX. Пройдите удобную регистрацию и откройте для себя весь функционал.Создать аккаунтШаг 2: Перейдите в Купить криптовалюту и выберите свой способ оплатыКредитная/Дебетовая Карта: Используйте свою карту Visa или Mastercard для мгновенной покупки USDS (USDS).Баланс: Используйте средства с баланса вашего аккаунта HTX для простой торговли.Третьи Лица: Мы добавили популярные способы оплаты, такие как Google Pay и Apple Pay, для повышения удобства.P2P: Торгуйте напрямую с другими пользователями на HTX.Внебиржевая Торговля (OTC): Мы предлагаем индивидуальные услуги и конкурентоспособные обменные курсы для трейдеров.Шаг 3: Хранение USDS (USDS)После приобретения вами USDS (USDS) храните их в своем аккаунте на HTX. В качестве альтернативы вы можете отправить их куда-либо с помощью перевода в блокчейне или использовать для торговли с другими криптовалютами.Шаг 4: Торговля USDS (USDS)С легкостью торгуйте USDS (USDS) на спотовом рынке HTX. Просто зайдите в свой аккаунт, выберите торговую пару, совершайте сделки и следите за ними в режиме реального времени. Мы предлагаем удобный интерфейс как для начинающих, так и для опытных трейдеров.

84 просмотров всегоОпубликовано 2026.04.13Обновлено 2026.04.13

Как купить USDS

Неделя обучения по популярным токенам 12: Крипто-конференция на 25 апреля 2026 года в Mar-a-Lago привлекает внимание, волна мем-монет вновь поднимается

Сообщество с большим нетерпением ожидает крипто-конференцию на 25 апреля 2026 года в Mar-a-Lago, многие рассматривают это как возможность «купить монету = приблизиться к президенту».

948 просмотров всегоОпубликовано 2026.04.14Обновлено 2026.04.14

Неделя обучения по популярным токенам 12: Крипто-конференция на 25 апреля 2026 года в Mar-a-Lago привлекает внимание, волна мем-монет вновь поднимается

Обсуждения

Добро пожаловать в Сообщество HTX. Здесь вы сможете быть в курсе последних новостей о развитии платформы и получить доступ к профессиональной аналитической информации о рынке. Мнения пользователей о цене на A (A) представлены ниже.

活动图片

Топ вопросы

Популярные категорииright-arrow

Популярные тегиright-arrow