CoinMarketCap, one of the world’s leading cryptocurrency price tracking platforms, fell victim to a sophisticated supply chain attack that resulted in the theft of over $43,000 from unsuspecting users.
## The Attack Unfolds
On January 20, visitors to CoinMarketCap began encountering suspicious Web3 popups requesting wallet connections. These seemingly legitimate prompts, branded with CoinMarketCap’s logo, were actually malicious wallet drainers designed to steal cryptocurrency from connected wallets.
The attack exploited a vulnerability in the site’s homepage “doodle” image feature. Cybercriminals modified the API responsible for retrieving these decorative images, injecting malicious JavaScript code into the legitimate website infrastructure.
## How the Breach Worked
According to cybersecurity firm c/side, the attackers compromised the JSON payload used to display homepage doodle images. This tampered data contained malicious script tags that loaded wallet-draining code from an external domain called “static.cdnkit[.]io.”
When users visited CoinMarketCap’s homepage, the malicious script automatically executed, displaying fake wallet connection popups that mimicked legitimate Web3 transaction requests. Users who connected their wallets unknowingly granted access to the drainer, which then stole their cryptocurrency assets.
## Damage Assessment
Intelligence from threat actor “Rey” revealed that the attack successfully compromised 110 victims, resulting in $43,266 in stolen cryptocurrency. Screenshots of the attackers’ control panel, shared on Telegram channels with French-speaking participants, confirmed the scope of the breach.
CoinMarketCap responded quickly once the vulnerability was discovered, removing the malicious content and implementing comprehensive security measures. The company confirmed that all systems are now operational and secure.
## Growing Threat Landscape
This incident highlights the increasing sophistication of cryptocurrency-related cyberattacks. Unlike traditional phishing attempts, modern wallet drainers spread through social media, malicious advertisements, spoofed websites, and compromised browser extensions.
The threat has reached alarming proportions, with wallet drainers stealing nearly $500 million in 2024 alone, targeting over 300,000 wallet addresses. The problem has become so widespread that Mozilla recently introduced specialized detection systems for wallet-draining browser extensions.
## Supply Chain Vulnerabilities
This attack demonstrates the particular danger of supply chain compromises, where cybercriminals target third-party services rather than the main platform directly. These attacks are especially difficult to detect because they exploit trusted components that users and security systems typically consider safe.
The CoinMarketCap incident serves as a stark reminder for cryptocurrency users to exercise extreme caution when connecting wallets to any platform, even trusted ones, and for organizations to implement robust security measures for all third-party integrations.