Multiple Crypto Attacks Expose Users and Platforms to Significant Losses

Within a single day, crypto users faced three major security breaches, including a $14 million theft of SOL tokens and malware distribution through compromised software packages.

Editorial Team · Jul 12, 2026 · 2 min read · Source: ambcrypto.com

Crypto platforms and users are confronting increasing threats as three distinct attacks unfolded within 24 hours, highlighting vulnerabilities from fake applications to high-value wallet breaches. The wave of incidents underscores the urgent need for vigilance against fraud and sophisticated hacking tactics.

One notable scam targeted SecondFi, where impersonators created counterfeit browser extensions and applications designed to steal funds or access user wallets. SecondFi clarified it has not launched any new apps or links and warned users never to download software, click suspicious links, or approve transactions via unsolicited messages. They emphasized using only the official Chrome extension marked with a blue verified check and accessing their services exclusively through the official website to mitigate phishing risks.

In another case, blockchain researcher ZachXBT identified the compromise of a major Solana whale wallet that resulted in the theft of 180,900 SOL—valued at around $14.2 million. The breach involved unusual unstaking of assets, followed by transfers to newly created Solana addresses. Attackers bridged the stolen funds to Ethereum to obscure transaction trails and tap broader liquidity pools. Further complicating recovery efforts, some of the stolen tokens were routed through Tornado Cash, a privacy tool that makes tracking funds extremely difficult.

Software supply chains also came under attack when the popular npm package jscrambler was infiltrated after its publishing credentials were stolen. Malicious code was injected into several package releases, affecting versions 8.14.0 through 8.20.0. Earlier versions used automated preinstall scripts to execute malware, but subsequent iterations embedded the payload directly into the package, bypassing typical security flags intended to block such activity. Developers were advised to upgrade immediately to version 8.22.0, which resolves the vulnerability.

These incidents collectively highlight three key attack vectors in the crypto ecosystem: phishing and fake apps aimed at everyday users, breach of high-value wallets linked to token unstaking and cross-chain laundering, and supply chain compromises targeting developer tools. Users and developers are urged to avoid unsolicited links, verify software authenticity, and promptly update compromised packages to safeguard their assets and systems.