The Solidity Language open-source package was used in a $500,000 crypto heist

A blockchain developer in Russia lost $500,000 in crypto assets due to a malicious Solidity Language extension for Cursor AI IDE. The fake extension, downloaded 54,000 times, appeared higher in search results than the legitimate one due to ranking algorithms. It installed malware that allowed remote access and data theft. The attackers used ScreenConnect for remote control and deployed various scripts to steal wallet passphrases. A new malicious package was published shortly after the first was removed, with an inflated download count of 2 million. Similar attacks were found targeting blockchain developers through other extensions and npm packages. The incident highlights the ongoing threat of malicious open-source packages in the crypto industry.

• Inside a Global AI-Assisted Hacking CampaignMalware2026-10-22
• RSVP to Disaster: How One Click Installs a RATMalware2026-10-13
• RMM Tools Being Distributed Through Phishing Attacks (ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, N-able)Malware2026-10-08
• 16 Malicious Firefox Extensions Steal Cryptocurrency Wallet CredentialsCampaign2026-10-08
• Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMsMalware2026-10-07