Threat actors have launched a fresh wave of cyberattacks aimed at crypto holders, specifically targeting users of Atomic and Exodus wallets through malicious software packages uploaded to coding platforms.
Security researchers warn that the malware, embedded within commonly used npm packages like pdf-to-office, is designed to harvest private keys by manipulating local wallet files.
According to analysis by ReversingLabs, the malicious code poses as legitimate software, but once installed, it stealthily modifies the user interface of Atomic and Exodus wallets. This manipulation tricks users into sending funds to addresses controlled by the attackers, effectively rerouting transactions without detection.
This kind of software supply chain attack highlights an increasingly dangerous trend in the crypto space, where hackers infiltrate development environments to carry out exploits at the infrastructure level.
The scale of such attacks continues to grow. In the first quarter of 2025 alone, cybersecurity firm Hacken estimates that crypto-related hacks and exploits resulted in losses exceeding $2 billion. A staggering $1.4 billion of that figure came from the Bybit hack in February - currently the largest in crypto history.
Following the incident, SafeWallet - a wallet provider implicated in the breach - shared a detailed post-mortem in March 2025. Investigators revealed that hackers compromised a developer's computer and hijacked AWS session tokens to infiltrate SafeWallet’s internal systems and orchestrate the Bybit theft.
Meanwhile, another deceptive tactic gaining traction is the "address poisoning" scam. Casa's chief security officer and well-known cypherpunk Jameson Lopp recently raised concerns over this subtle yet effective exploit.
In these attacks, scammers generate wallet addresses that visually resemble those in a victim’s transaction history - typically by mimicking the first and last few characters. A small transaction is then sent to the victim to implant the fake address into their history. If the user unknowingly reuses this address, their funds are redirected to the attacker.
Cyvers, a cybersecurity firm monitoring blockchain threats, reported that address poisoning alone led to over $1.2 million in stolen crypto during March 2025.
As threat actors evolve their methods, from manipulating development tools to exploiting user habits, cybersecurity professionals are calling for heightened vigilance across all fronts of the crypto ecosystem.