Crypto Wallets Targeted In JavaScript Library Exploit—Cybersecurity Firm

bitcoinist2025-12-16 tarihinde yayınlandı2025-12-16 tarihinde güncellendi

Özet

A critical vulnerability (CVE-2025-55182) in React Server Components (versions 19.0 to 19.2.0) is being actively exploited to inject malicious code into websites and steal cryptocurrency from connected wallets. The flaw, which allows unauthenticated attackers to execute arbitrary code on affected servers, has led to wallet-draining campaigns across multiple crypto sites. Cybersecurity firm Security Alliance (SEAL) warns that attackers are using the exploit to inject scripts that hijack or redirect transactions by altering user interfaces or swapping addresses. Over 50 organizations have reported compromise attempts, with scanning tools and exploit kits rapidly spreading in underground forums. Patched versions (19.0.1, 19.1.2, 19.2.1) are available, and all affected sites are urged to update immediately.

A critical flaw in React Server Components is being used by attackers to inject malicious code into live websites, and that code is siphoning crypto from connected wallets.

Reports note that the vulnerability, tracked as CVE-2025-55182, was published by the React team on December 3 and carries a maximum severity rating.

Cybersecurity firm Security Alliance (SEAL) has confirmed that multiple crypto websites are actively being targeted, and they urge operators to review all React Server Components immediately to prevent wallet-draining attacks.

Security teams say the bug allows an unauthenticated attacker to run code on affected servers, which has been turned into wallet-draining campaigns across several sites.

Image: Shutterstock

A Wide Risk To Sites Using Server Components

SEAL said the flaw affects React Server Components packages in versions 19.0 through 19.2.0, and patched releases such as 19.0.1, 19.1.2, and 19.2.1 were issued after disclosure.

The vulnerability works by exploiting unsafe deserialization in the Flight protocol, letting a single crafted HTTP request execute arbitrary code with the web server’s privileges. Security teams have warned that many sites using default configurations are at risk until they apply the updates.

Attackers Inject Wallet-Draining Scripts Into Compromised Pages

According to industry posts, threat actors are using the exploit to plant scripts that prompt users to connect Web3 wallets and then hijack or redirect transactions.

In some cases the injected code alters the user interface or swaps addresses, so a user believes they are sending funds to one account while the transaction actually pays an attacker. This method can hit users who trust familiar crypto sites and connect wallets without checking every approval.

BTCUSD now trading at $89,626. Chart: TradingView

Scanners And Proof-Of-Concepts Flooded Underground Forums

Security researchers report a rush of scanning tools, fake proof-of-concept code, and exploit kits shared in underground forums shortly after the vulnerability was disclosed.

Cloud and threat-intelligence teams have observed multiple groups scanning for vulnerable servers and testing payloads, which has accelerated active exploitation.

Some defenders say that the speed and volume of scanning have made it hard to stop all attempts before patches are applied.

More Than 50 Organizations Reported Compromise Attempts

Based on reports from incident responders, post-exploitation crypto activity has been observed at more than 50 organizations across finance, media, government, and tech.

In several investigations, attackers established footholds and then used those to deliver further malware or to seed front-end code that targets wallet users.

SEAL has emphasized that organizations failing to patch or monitor their servers could experience further attacks, and ongoing monitoring is essential until all systems are verified safe.

Featured image from Unsplash, chart from TradingView

İlgili Okumalar

How Difficult is Chip Making? A Division Error Costs 475 Million Dollars

How Hard Is It to Make a Chip? A Division Error Cost $475 Million Chip expert Shi Kan, a researcher at the Chinese Academy of Sciences and a popular tech creator, explains the immense challenges of chip development. Chips are foundational to modern technology, but their creation is extraordinarily difficult. The journey from sand to a functional chip involves complex design and manufacturing, but a critical bottleneck is verification—ensuring the design works flawlessly before costly production. A single, undetected bug can have catastrophic consequences, as illustrated by the infamous 1994 Intel Pentium FDIV bug. A flaw in the floating-point division unit forced a recall costing $475 million. Unlike software, chips cannot be easily patched after manufacture, making "first-time success" paramount. However, industry surveys show only 24% of chip projects achieve this; over three-quarters require at least one costly re-spin due to design flaws. Verification has thus become the dominant phase, consuming up to 70% of the design cycle. The core challenge is a "verification impossible triangle" between high performance, good debuggability, and low cost. Exhaustively verifying a modern CPU core could take 15,000 years with software simulation, or 30 years with advanced hardware emulation—timeframes utterly impractical for development. Despite being essential, verification is often seen as unglamorous "dirty work," receiving less academic attention than fields like AI. Shi and his team are tackling this by developing an agile verification research framework called ENCORE, based on FPGA technology, to improve verification efficiency and debug capability. Beyond research, Shi engages in public science communication through long-form video content, aiming to demystify chip technology, AI, and computer science. He argues for the value of pursuing "hard and long-term" endeavors, whether in the meticulous world of chip verification or in creating substantive educational content, believing such sustained effort is likely the right path forward.

marsbit6 dk önce

How Difficult is Chip Making? A Division Error Costs 475 Million Dollars

marsbit6 dk önce

Claude to Mandate "Face-Scan ID Verification", No ID No Service Starting July?

Anthropic, the creator of Claude AI, has sent privacy policy update emails to users, signaling a significant shift. The key change, effective July 8, is the potential requirement for consumer-level users (Free, Pro, Max plans) to verify their age or identity. This verification would be conducted through the third-party service Persona, involving uploading a government-issued photo ID and taking a live selfie for comparison. Anthropic states this data is for security purposes only, will not be used for model training, and is processed by Persona, not stored on its own servers. The update also clarifies data handling for Claude's new capabilities: when performing multi-step tasks or connecting to third-party apps, user data may flow between Anthropic and those external services. Additionally, more information may be collected from users who participate in Anthropic research. This move is seen as a major step towards establishing accountability as AI agents become more powerful and autonomous, capable of executing complex, real-world tasks. It follows previous enforcement actions, like the banning of the "Fable 5" account, and indicates a broader industry trend toward stricter user identification and safety measures. The verification is expected to apply in specific scenarios, particularly as users engage Claude in more complex agentic workflows.

链捕手18 dk önce

Claude to Mandate "Face-Scan ID Verification", No ID No Service Starting July?

链捕手18 dk önce

Blockchain Has Finally Started to Sail into the Mainstream After 18 Years

Blockchain Finds Its True Path After 18 Years: Becoming the Financial Backbone for AI Agents and Autonomy This analysis explores a pivotal shift in the blockchain and crypto investment landscape, driven by the dominance of AI. Major venture capital firms, including Variant, Paradigm, Haun Ventures, and YZi Labs, are moving beyond pure "crypto" investment theses. They are expanding their focus to AI, robotics, and frontier tech, signaling that blockchain is no longer seen as a standalone sector but as an underlying infrastructure layer. The core argument is that blockchain's killer application may not be user-facing apps, but rather providing the economic rails for the coming wave of AI agents, autonomous robots, and automated systems. Key capabilities like self-custody wallets, programmable stablecoins for micropayments, on-chain identity, and verifiable smart contracts are positioned as essential for a future where machines conduct economic activity. The recent $1.4 billion investment by Tether (via its venture arm) in German robotics company NEURA Robotics exemplifies this, aiming to embed Tether's wallet tools directly into robots for autonomous transactions. While many "AI + Crypto" projects remain superficial, the article concludes that true value lies where crypto is a necessary component—enabling machine-to-machine payments, agent autonomy, verifiable data provenance, and open financial settlement for the AI era. For crypto venture capital, this convergence with AI represents both an adaptation to shifting capital flows and a potential path to unlocking the large-scale, non-speculative utility the industry has long sought.

marsbit26 dk önce

Blockchain Has Finally Started to Sail into the Mainstream After 18 Years

marsbit26 dk önce

Blockchain has finally begun sailing toward the main channel after 18 years

After 18 years of development, blockchain technology is beginning to move from a specialized niche into mainstream adoption, according to a recent industry analysis. The shift is reflected in the changing strategies of major crypto venture capital firms, which are expanding their focus beyond pure "digital ownership" towards broader themes like "autonomy." The report highlights that leading VC firms like Variant, Paradigm, Haun Ventures, and YZi Labs are broadening their investment mandates to include not only crypto but also artificial intelligence (AI), robotics, biotech, and other frontier technologies. This reflects a recognition that the isolated "crypto investment" narrative is losing appeal to limited partners (LPs) as capital and attention increasingly flow toward AI and other high-growth tech sectors. A key emerging thesis is that blockchain's most significant future application may not be as a consumer-facing product, but as the underlying economic and settlement infrastructure for the AI era. As AI agents and autonomous systems become more prevalent, they will require programmable, global, and low-cost payment networks (like stablecoins), verifiable digital identities, and secure wallets to manage transactions and assets on behalf of users. The investment by stablecoin issuer Tether into robotics company NEURA, with plans to integrate its wallet technology, is cited as a prime example of this convergence. However, the article cautions that simply labeling projects as "AI + Crypto" is insufficient. True value lies in integrations where blockchain technology is essential—such as enabling machine-to-machine micropayments, verifiable data provenance for AI, or transparent governance for autonomous organizations—rather than being a superficial marketing add-on. In conclusion, while AI currently dominates the tech narrative and capital flows, it may ultimately create the real-world, high-frequency demand that the crypto industry has long sought. For crypto VCs and projects, the path forward is to position blockchain not as a competing sector, but as a critical foundational layer powering autonomy and economic activity in an AI-driven future.

链捕手33 dk önce

Blockchain has finally begun sailing toward the main channel after 18 years

链捕手33 dk önce

Y Combinator Co-founder: How to Make a Billion Dollars?

The Y Combinator co-founder argues that becoming a billionaire by founding a successful startup is not only possible but demonstrably achievable without unfair or unethical practices. He disputes a politician's claim to the contrary, using the example of a founder whose company grew at 93% monthly solely through creating a product users loved and recommended. The core mechanism is exponential growth. A conservative 15% monthly growth rate compounds to a 4384x increase over five years, which can easily lead to billion-dollar valuations and founder wealth. The process depends on two key variables: the growth rate and the duration it can be sustained. A high growth rate stems from a great product that users naturally promote, while a long duration requires a large enough market. For aspiring founders, especially young ones, the simplest path is to build something they and their friends genuinely need. Young people's current needs often predict future mass-market trends. He advises against actively "searching" for ideas, as this tends to filter out unconventional but promising ones. Instead, inspiration should come from working on interesting projects with friends, as many iconic companies (e.g., Apple, Facebook) started this way. Ultimately, building a massively valuable startup is not about exploitation but empathy: deeply understanding a user group and building a product that significantly improves their lives. This, powered by exponential growth in a large market, is the legitimate path to immense wealth creation.

Foresight News35 dk önce

Y Combinator Co-founder: How to Make a Billion Dollars?

Foresight News35 dk önce

İşlemler

Spot
Futures
活动图片