Decentralized exchange aggregator 1Inch’s website has been breached along with multiple other platforms that use the same frontend library, Lottie Player.
The breach originated from malicious code injected into the Lottie Player, a widely-used animation library used by several dApps and non-crypto websites. As of now, no user wallets have been reportedly compromised.
1inch Users Cautioned Against Any Interactions
According to several posts on X (formerly Twitter), 1Inch and TEN Finance are the confirmed victims of this attack so far. However, the number could be much higher, as the exploit targeted Lottie Player versions 2.0.5 and above.
Hackers have reportedly injected malicious code into the front-end JSON files of websites using these versions. This code now enables the compromised sites to perform unauthorized transactions, posing a severe threat to users’ assets and data.
Reports from Blockaid indicate that the attack was introduced through a compromise of Lottie Player’s content server, where a malicious npm package was used to distribute altered code. Blockaid and other security firms have confirmed the injection of unauthorized scripts within the package.
“Legitimate sites (non crypto as well) are now serving malicious content, including anti-debug evasion code. @LottieFiles, it looks like attackers have managed to push malicious versions of your package, with another version being uploaded now,” Blockaid wrote in an X (formerly Twitter) post.
At the time of writing, 1inch hasn’t released any official statement on the breach. However, the Lottie Player team has confirmed that they were able to identify the cause of the breach and are working on removing the affected versions.
Users are strictly advised to avoid connecting wallets or interacting with affected platforms until the security issues are fully resolved.
Community post on the 1Inch Discord channel
Crypto Hacks Continue To Escalate
Security breaches have been the most plaguing issue of the crypto industry, and malicious activities continue to grow every year.
Most recently, hackers reportedly stole $20 million worth of cryptocurrencies from the US government. The funds were also part of the $3.6 billion that the feds seized from the Bitfinex hackers.
Blockchain lender Radiant Capital suffered one of the biggest hacks of this year, losing more than $50 million. The hackers gained control of the firm’s private keys and rapidly drained these assets.
However, the investigation and prosecution of these crimes have also intensified. FBT recently arrested the SEC X (formerly Twitter) account hacker. The accused is a 25-year-old Alabama man named Eric Council Jr.
Earlier this year, the Council allegedly hacked the SEC’s X account and posted false news about Bitcoin ETF approvals, which significantly affected the market. Yet, the feds believe Council wasn’t the brains of this operation and they are trying to negotiate a plea deal with him.
So far, crypto hacks have exceeded $2.1 billion in 2024, with CeFi platforms taking the biggest hits.