TLDR
- Hackers added malware to NPM packages downloaded over 1 billion times.
- Less than $50 in crypto was stolen despite a major supply chain attack.
- Ethereum and Solana wallets were specifically targeted by the malware.
- Major crypto apps like Ledger and MetaMask were unaffected by the attack.
Hackers accessed a well-known developer’s NPM account and injected malware into popular JavaScript libraries. The malware targeted cryptocurrency wallets, including Ethereum and Solana addresses. Security researchers report that less than $50 in crypto has been stolen so far.
The breach affects widely used packages such as chalk, strip-ansi, and color-convert, which are often buried deep in dependency trees. Millions of crypto projects could have been exposed even if developers did not install the packages directly.
Minimal Loss Despite Large-Scale Breach
Crypto intelligence platform Security Alliance said the malicious activity resulted in almost no financial damage. The Ethereum wallet address “0xFc4a48” was identified as the only known address receiving stolen funds.
Pseudonymous security researcher Samczsun, also known as SEAL, “The hacker didn’t fully capitalize on the amount of access they had. It’s like finding the keycard to Fort Knox and using it as a bookmark.”
At first, the theft appeared to be only five cents in Ether, but that figure later rose to around $50, including small amounts of memecoins such as Brett, Andy, and Dork Lord.
Crypto Wallets Largely Safe
Security teams from major crypto wallets confirmed that their platforms were unaffected by the NPM breach. Ledger and MetaMask said their systems have multiple layers of defense. Phantom Wallet and Uniswap also reported that none of their apps were at risk.
Despite the limited theft, experts caution that only crypto projects updating after the malware’s release may face exposure. Users must approve transactions for the malware to redirect funds, reducing the risk of automatic losses.
Charles Guillemet, Ledger CTO, advised caution: “Always verify on-chain transactions carefully, even if you trust the platform.”
Broader Trends in Crypto Security
2025 has already seen over $2.17 billion stolen from cryptocurrency services, exceeding losses in previous years. North Korea’s $1.5 billion hack of ByBit is the largest single theft recorded in crypto history, dwarfing the NPM attack.
Personal wallet compromises have become a larger share of total ecosystem theft, now representing 23% of stolen funds this year. Security analysts note that stolen funds often remain on-chain rather than being immediately laundered.
The NPM breach illustrates the growing importance of supply chain security for cryptocurrency developers. Even widely used and trusted libraries can become attack vectors if accounts are compromised.
