Lottie Player 遭遇供应链攻击，从Avalanche钱包中窃取 10 个包装好的 BTC
Lottie Player 遭到供应链攻击，影响了一个装有 10 个Bitcoin(BTC) 的钱包。 Wordpress 工具已被滥用，向 Web3 用户发送恶意链接，从而有效地耗尽了钱包。
Lottie Player（Wordpress 动画库）已被用作 Web3 用户的攻击媒介。通过恶意链接，至少一个钱包已被盗走 10 个Bitcoin(BTC)。
Lottie Player 攻击影响了 1inch 和 Mover 等广泛使用的项目。 1inch 攻击可能特别有害，因为 DEX 交易服务是Ethereum上使用最广泛的服务之一。
Blockaid 还报告称，它一直在通过其网站传播恶意钱包连接。 Bubble是另一个受恶意弹出窗口影响的前端网站，也是最先被报告的网站之一。 Bubble 也是构建第三方应用程序的来源，这些应用程序可能会在旧版本处于活动状态时受到影响。
Blockaid 的研究人员已确定Ace Drainer 是最有可能的攻击源。 Lottie Player 的恶意版本已被删除，但在此之前，它传播了用于与广泛使用的 Web3 钱包进行签名的虚假链接。该攻击已持续至少 12 小时，导致多个dent的攻击钱包中的余额增加。
当钱包被耗尽 10 BTC 时，该攻击首次被注意到，从而导致了虚假链接的来源。风险在于快速签署所有请求，包括永久访问钱包。这使得攻击者甚至可以耗尽Avalanche C 链地址，窃取某种形式的包装 BTC 。攻击本身并不要求自我托管的Bitcoin钱包，而是依赖于 Web3 连接的需求。
⚠️ 3 小时前，受害者因签署网络钓鱼交易而损失 10 BTC（723,436 美元）。
这起盗窃事件可能与今天早些时候对 Lottie Player 的供应链攻击有关。 https://t.co/Puq5zUnKO9 pic.twitter.com/STYgRGgyK9
— 诈骗嗅探器 | Web3 反诈骗 (@realScamSniffer) 2024 年 10 月 31 日
Users also noted the Lottie Player would populate a Web3 route with a malicious transaction when used for websites in the usual way. Analysts noted the attack targeted Ethereum and EVM-compatible chains.
The attackers’ addresses continue to show activity, affecting small holdings of various Web3 tokens. For now, the entire size of the attack has not been accounted, and may have affected other tokens. The attackers are swapping the tokens quickly through Uniswap, or even through MetaMask swap.
Lottie Player attack spread to multiple sites
The Lottie Player attack displayed a very familiar screen for Web3 users, urging them to connect some of the top wallets, including MetaMask, WalletConnect, and others.
Even the TryHackMe platform experienced the popup, but moved to an older version. The issue has been reported by other users of popular websites.
The attack affected two versions of Lottie Player, first noticed late on October 30. The attacks originated from versions 2.0.5 or higher. Website owners had to clear the attack themselves in the initial hours, by reverting to other tools or older versions of Lottie Player. Some have chosen to delete the scripts as a precaution.
Wallet owners may still have to revoke permissions, if they have connected to any of the injected links. Sites like 1inch draw in more than 590K monthly users, and may have affected multiple undetected wallets.
Lottie Player team publishes safe version
The Lottie Player team reacted by uploading a legitimate new version 2.0.8, while unpublishing the contaminated scripts. The team noted the faulty versions were three in total, published directly to NPM using a compromised access token from a developer with the required publishing privileges. The team notes no other repositories or libraries have been affected.
Lottie Player is widely used for animations and minor features on websites, but has been added to the list of distributors for malicious links. Those types of attacks target individual wallets, adding to the risk of poisoned addresses, direct targeting in email and messages, and fake website versions.
The attack happens during the next stage of a crypto bull market, accelerating attempts to steal more valuable tokens. Connecting a wallet is best done for a specific purpose, avoiding full-time permissions for signing transactions. Launching a wallet connection immediately after entering a website may be a red flag.
相关文章
TradingKey2025市场回顾与前瞻 | 黄金半世纪来表现最佳 华尔街大行高喊2026年冲破5000美元！
TradingKey - 在全球经济不确定性加剧的背景下，黄金正在经历自1979年以来表现最佳的一年，创下46年来的最大涨幅。2025年即将结束，华尔街大行确认了黄金最佳避险资产的地位，且形成共识：2026年黄金还要继续涨。
TradingKey市场回顾与前瞻｜2025年比特币价格屡创新高，2026年能否再写传奇？
2025年的多重利好推动比特币创新高，但利好已多兑现，2026年面临流动性收紧、监管与货币政策不确定等挑战。华尔街对比特币未来看法分歧，目标价范围在6.5-17万美元区间，价格既有再创新高的可能性，也存在进一步回调的风险。
TradingKey2025市场回顾与前瞻 | 华尔街2026年美股预测：标普500直冲8000点！AI神话未完但大轮动已开启！周期股有望起飞
TradingKey - 2025年已进入尾声，回望这一年，美股市场轮番上演着精彩和惊人的时刻。2026年将近，华尔街大行对美股前景依然充满信心，对标普500指数的平均预测值达到7500点。AI依然会是美股新一年增长的主题，但将伴随着高波动性。另外，美股的资金轮动在悄然发生，周期性股票需要持续关注。
