Home > Top > Body

Animation Tool Lottie Player Hit by Supply Chain Attack, Causes $723K Bitcoin Theft

clock
2024-10-31 05:34:23

A major security breach has impacted multiple decentralized applications (dApps), with the attack stemming from malicious code injected into Lottie Player, a widely-used JavaScript animation library. 

The attack exploited recent updates to Lottie Player’s npm package, specifically in versions 2.0.5 through 2.0.7, where hackers embedded malicious code within JSON files that display animations on websites. 

At least one individual has lost 10 BTC (US$723,000) after unknowingly signing a phishing transaction linked to the breach, according to Scam Sniffer, a platform designed to protect users from online fraud.

Blockaid, a cybersecurity platform monitoring the incident, confirmed Wednesday the attackers deployed a fake wallet connection prompt, leading users to the drainer malware "Ace Drainer," which mimics legitimate connections to deceive users.

According to Blockaid, the hackers added harmful code into Lottie Player’s files, turning these animations into entry points for potential scams. Essentially, when users visited sites with this compromised library, they were shown fake pop-ups asking them to connect their digital wallets.

However, these prompts were controlled by hackers and could grant them unauthorized access to users’ funds.

In response to the attack, LottieFiles’ vice president of engineering, Jawish Hameed, confirmed Wednesday that affected versions were removed from npm, and a safe version (2.0.8) was released. 

LottieFiles pointed Decrypt to its public statement regarding the breakdown of events when asked for comment.

Hameed noted the breach involved the GitHub account of a senior engineer, through which attackers pushed three compromised updates in just three hours on Tuesday. 

LottieFiles has since revoked all access from the affected developer account and taken further steps to prevent future incidents.

This type of “supply chain attack”—where hackers infiltrate widely-used software that many websites rely on—can have widespread consequences. In this case, the compromised Lottie Player versions were automatically pulled into many sites, making it easier for hackers to reach users.

Decentralized aggregator platform 1inch, one of the main targets of the attack, reassured users on social media that only its web dApp was affected and that the wallet app and core protocols remain secure. 

Security compromises in widely used libraries and tools have become a critical issue as hackers exploit vulnerabilities that allow them access to unsuspecting users’ assets. 

Earlier this month, a PEPE token holder lost $1.39 million after unknowingly signing a malicious Permit2 transaction.

Edited by Sebastian Sinclair

Web3 Desktop Trading Tool
Stay ahead of the game in the cryptocurrency space.

7x24 Newsflash

14:40 2025-06-12
Binance Wealth Management, One-Click Buy Coin, Flash Exchange, Leverage Online Defi App (HOME)
According to Binance's announcement, HOME's guaranteed capital earning current product was launched at 23:00 (UTC + 8) on June 12, and simultaneously supports "one-click coin buying", flash exchange, and leveraged trading services. Within one hour of the spot launch, users can trade HOME with their credit card or wallet balance, and can also exchange it for BTC, USDT, etc. free of handling fees. The leveraged platform will simultaneously open HOME borrowing and trading pairs.
14:28 2025-06-12
Sonic Labs has invested 400,000 S tokens in Hey Anon
Sonic Labs announced in a post on the X platform that it has invested 400,000 S tokens in the Hey Anon project through its Sonic Innovator Fund. Hey Anon is an on-chain AI protocol that aims to redefine users' interaction patterns with DeFi on Sonic.
14:13 2025-06-12
Hong Kong Customs has teamed up with the University of Hong Kong to develop a cryptocurrency tracking tool
The Hong Kong Customs and Excise Department has teamed up with the University of Hong Kong to develop a cryptocurrency transaction tracking tool to tackle the growing number of digital asset money laundering cases. Assistant Commissioner of Customs and Excise Wong Ho-yin said the move was aimed at cracking down on cross-border financial crimes. Between 2021 and May 2025, Hong Kong reportedly recorded 39 major money laundering cases, seven of which involved cryptocurrencies, including one suspici...
14:13 2025-06-12
WLFI official website has added exchange, lending and APP modules, and the functions are not yet open
The WLFI official website has been updated with new exchange (Swap), lending and WLFI APP modules. At present, the above functions are still in the pre-announced state and have not been officially turned on.
14:04 2025-06-12
Analysis: 20 times leverage BTC giant whale identity as Aguila Trades
According to Lookonchain monitoring, the mysterious whale address 0x1f25 has been identified as X user @AguilaTrades. In the past 4 days, it has transferred 29.85 million USDC from Bybit to Hyperliquid for 20x leverage to go long BTC. At present, it has lost more than 5.50 million dollars - but when the price of Bitcoin fell again, it chose to increase its position and continue to go long.
13:46 2025-06-12
Goldman Sachs: Lower the probability of a 12-month U.S. recession from 35% to 30%.
Goldman Sachs: Lower the probability of a 12-month U.S. recession from 35% to 30%.
13:31 2025-06-12
Trident Announces $500 million Funding Plan for XRP Vault
According to BWENEWS, Trident announced plans to raise up to $500 million for XRP Vault and appointed Chaince Securities LLC as strategic advisor.
13:21 2025-06-12
JPMorgan Chase, Chainlink and Ondo Finance complete cross-chain payment settlement test
According to Cointelegraph, Chainlink, JPMorgan's Kinexys, and Ondo Finance have completed a "first-of-its-kind" cross-chain payment delivery (DvP) settlement test, enabling the exchange of assets between a licensed payment network and a public test network. According to Chainlink, the test involved Kinexys Digital Payments, a permissioned network operated by JPMorgan, and the Ondo Chain testnet focused on real-world asset (RWA) tokenization. The settlement was conducted by Chainlink's Runtime E...
13:06 2025-06-12
Hong Kong Securities Supervision Commission Huang Tianyou: We are considering comprehensively optimizing the Shanghai, Shenzhen and Hong Kong Stock Connect, and studying and adjusting the number of shares traded per lot in Hong Kong stocks
At the Asian Traders Forum Annual Conference and Stock Trading Summit 2025, Huang Tianyou, chairperson of the Hong Kong Securities Supervision Commission, said that the Hong Kong Securities Supervision Commission, in cooperation with the Hong Kong Stock Exchange, will reduce the minimum up and down price of applicable securities by 50% to 60% in two phases starting from mid-2025, thereby reducing overall trading costs and improving liquidity. In the medium and long term, the Hong Kong Securities...
13:03 2025-06-12
Golden Evening News | List of important developments on the evening of June 12
12:00-21:00 Keywords: Antnoidae, DXY, Meta, BlackRock 1. Ant Digital starts applying for a Hong Kong stablecoin license Traders once again fully priced in the Federal Reserve's two interest rate cuts this year 3. The dollar index DXY fell 1.00% in the day and is now at 97.65. 4. Binance HODLer Airdrop Launches Defi App (HOME) 5. US senators investigate Facebook parent company Meta's stablecoin plan 6. BlackRock: Aims to become the world's largest crypto asset manager by 2030
12:54 2025-06-12
Cross-border e-commerce company DDC Enterprise increases its holdings of 38 BTC, bringing its total holdings to 138 BTC.
Cross-border e-commerce company DDC Enterprise announced the addition of 38 bitcoins to the company's vault, bringing its total holdings to 138 BTC. Since May this year, its bitcoin investment has achieved a 22% return. The company said it will continue to implement a strict bitcoin accumulation strategy, further strengthening its strategic goal of becoming the world's top corporate treasury.
12:54 2025-06-12
US PPI remains moderate in May, tariff effect or "late strike"
Core US PPI data for May fell short of expectations on the modest impact of the cost of goods and services, the Bureau of Labor Statistics reported on Thursday. Although the impact of higher tariffs on Americans is not yet significant, economists pointed out that price pressures could intensify in the second half of the year as companies try to avoid further weakening margins. PPI data showed that wholesalers and retailers' profit margins rose in May after falling in April.