A newly discovered loophole in one of the web’s most used development tools is giving hackers a new way to drain cryptocurrency wallets. Cybersecurity researchersA newly discovered loophole in one of the web’s most used development tools is giving hackers a new way to drain cryptocurrency wallets. Cybersecurity researchers

Second JavaScript Exploit in Four Months Exposes Crypto Sites to Wallet Drainers

2025/12/15 21:38
2분 읽기
이 콘텐츠에 대한 의견이나 우려 사항이 있으시면 crypto.news@mexc.com으로 연락주시기 바랍니다

A newly discovered loophole in one of the web’s most used development tools is giving hackers a new way to drain cryptocurrency wallets.

Cybersecurity researchers have reported a surge in malicious code uploaded to legitimate websites through a vulnerability in the popular JavaScript library React — a tool used by countless crypto platforms for their front-end systems.

Crypto Drainer Attacks Surge via React Flaw

According to Security Alliance (SEAL), a nonprofit cybersecurity organization, criminals are actively exploiting a recently disclosed React vulnerability labeled CVE-2025-55182.

“We are observing a big uptick in drainers uploaded to legitimate crypto websites through exploitation of the recent React CVE,” SEAL stated on X (formerly Twitter). “All websites should review front-end code for any suspicious assets NOW.

  • HP CEO “Exposes” Ink Cartridge Vulnerability Triggering Legal Storm
  • Exness Rewards Up to $10,000 in New Bug Bounty Program
  • How to Increase Business Security Using a Honeypot

The flaw enables unauthenticated remote code execution, allowing attackers to secretly inject wallet-draining scripts into websites. The malicious code tricks users into approving fake transactions via deceptive pop-ups or reward prompts.

Read more: Hackers Exploit JavaScript Accounts in Massive Crypto Attack Reportedly Affecting 1B+ Downloads

SEAL cautioned that some compromised sites may be unexpectedly flagged as phishing risks. The organization advised web administrators to conduct immediate security audits to catch any injected assets or obfuscated JavaScript.

"If your project is getting blocked, that may be the reason. Please review your code first before requesting phishing page warning removal. The attack is targeting not only Web3 protocols! All websites are at risk. Users should exercise caution when signing ANY permit signature."

Phishing Flags and Hidden Drainers

The group warned that developers who find their projects mistakenly blocked as phishing pages should inspect their code first before appealing the warning.

The React development team confirmed on December 3 that it had patched the vulnerability after white hat hacker Lachlan Davidson privately reported the issue.

The fix affects the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages. The team urged all developers using these components to update immediately.

시장 기회
Ambire Wallet 로고
Ambire Wallet 가격(WALLET)
$0.0091
$0.0091$0.0091
-0.10%
USD
Ambire Wallet (WALLET) 실시간 가격 차트
면책 조항: 본 사이트에 재게시된 글들은 공개 플랫폼에서 가져온 것으로 정보 제공 목적으로만 제공됩니다. 이는 반드시 MEXC의 견해를 반영하는 것은 아닙니다. 모든 권리는 원저자에게 있습니다. 제3자의 권리를 침해하는 콘텐츠가 있다고 판단될 경우, crypto.news@mexc.com으로 연락하여 삭제 요청을 해주시기 바랍니다. MEXC는 콘텐츠의 정확성, 완전성 또는 시의적절성에 대해 어떠한 보증도 하지 않으며, 제공된 정보에 기반하여 취해진 어떠한 조치에 대해서도 책임을 지지 않습니다. 본 콘텐츠는 금융, 법률 또는 기타 전문적인 조언을 구성하지 않으며, MEXC의 추천이나 보증으로 간주되어서는 안 됩니다.

Roll the Dice & Win Up to 1 BTC

Roll the Dice & Win Up to 1 BTCRoll the Dice & Win Up to 1 BTC

Invite friends & share 500,000 USDT!