A newly discovered loophole in one of the web’s most used development tools is giving hackers a new way to drain cryptocurrency wallets. Cybersecurity researchersA newly discovered loophole in one of the web’s most used development tools is giving hackers a new way to drain cryptocurrency wallets. Cybersecurity researchers

Second JavaScript Exploit in Four Months Exposes Crypto Sites to Wallet Drainers

A newly discovered loophole in one of the web’s most used development tools is giving hackers a new way to drain cryptocurrency wallets.

Cybersecurity researchers have reported a surge in malicious code uploaded to legitimate websites through a vulnerability in the popular JavaScript library React — a tool used by countless crypto platforms for their front-end systems.

Crypto Drainer Attacks Surge via React Flaw

According to Security Alliance (SEAL), a nonprofit cybersecurity organization, criminals are actively exploiting a recently disclosed React vulnerability labeled CVE-2025-55182.

“We are observing a big uptick in drainers uploaded to legitimate crypto websites through exploitation of the recent React CVE,” SEAL stated on X (formerly Twitter). “All websites should review front-end code for any suspicious assets NOW.

  • HP CEO “Exposes” Ink Cartridge Vulnerability Triggering Legal Storm
  • Exness Rewards Up to $10,000 in New Bug Bounty Program
  • How to Increase Business Security Using a Honeypot

The flaw enables unauthenticated remote code execution, allowing attackers to secretly inject wallet-draining scripts into websites. The malicious code tricks users into approving fake transactions via deceptive pop-ups or reward prompts.

Read more: Hackers Exploit JavaScript Accounts in Massive Crypto Attack Reportedly Affecting 1B+ Downloads

SEAL cautioned that some compromised sites may be unexpectedly flagged as phishing risks. The organization advised web administrators to conduct immediate security audits to catch any injected assets or obfuscated JavaScript.

"If your project is getting blocked, that may be the reason. Please review your code first before requesting phishing page warning removal. The attack is targeting not only Web3 protocols! All websites are at risk. Users should exercise caution when signing ANY permit signature."

Phishing Flags and Hidden Drainers

The group warned that developers who find their projects mistakenly blocked as phishing pages should inspect their code first before appealing the warning.

The React development team confirmed on December 3 that it had patched the vulnerability after white hat hacker Lachlan Davidson privately reported the issue.

The fix affects the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages. The team urged all developers using these components to update immediately.

Market Opportunity
MetaDOS Logo
MetaDOS Price(SECOND)
$0.0000038
$0.0000038$0.0000038
0.00%
USD
MetaDOS (SECOND) Live Price Chart
Disclaimer: The articles reposted on this site are sourced from public platforms and are provided for informational purposes only. They do not necessarily reflect the views of MEXC. All rights remain with the original authors. If you believe any content infringes on third-party rights, please contact service@support.mexc.com for removal. MEXC makes no guarantees regarding the accuracy, completeness, or timeliness of the content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be considered a recommendation or endorsement by MEXC.

You May Also Like

What We Know (and Don’t) About Modern Code Reviews

What We Know (and Don’t) About Modern Code Reviews

This article traces the evolution of modern code review from formal inspections to tool-driven workflows, maps key research themes, and highlights a critical gap
Share
Hackernoon2025/12/17 17:00
X claims the right to share your private AI chats with everyone under new rules – no opt out

X claims the right to share your private AI chats with everyone under new rules – no opt out

X says its Terms of Service will change Jan. 15, 2026, expanding how the platform defines user “Content” and adding contract language tied to the operation and
Share
CryptoSlate2025/12/17 19:24
Michael Saylor Pushes Digital Capital Narrative At Bitcoin Treasuries Unconference

Michael Saylor Pushes Digital Capital Narrative At Bitcoin Treasuries Unconference

The post Michael Saylor Pushes Digital Capital Narrative At Bitcoin Treasuries Unconference appeared on BitcoinEthereumNews.com. The suitcoiners are in town.  From a low-key, circular podium in the middle of a lavish New York City event hall, Strategy executive chairman Michael Saylor took the mic and opened the Bitcoin Treasuries Unconference event. He joked awkwardly about the orange ties, dresses, caps and other merch to the (mostly male) audience of who’s-who in the bitcoin treasury company world.  Once he got onto the regular beat, it was much of the same: calm and relaxed, speaking freely and with confidence, his keynote was heavy on the metaphors and larger historical stories. Treasury companies are like Rockefeller’s Standard Oil in its early years, Michael Saylor said: We’ve just discovered crude oil and now we’re making sense of the myriad ways in which we can use it — the automobile revolution and jet fuel is still well ahead of us.  Established, trillion-dollar companies not using AI because of “security concerns” make them slow and stupid — just like companies and individuals rejecting digital assets now make them poor and weak.  “I’d like to think that we understood our business five years ago; we didn’t.”  We went from a defensive investment into bitcoin, Saylor said, to opportunistic, to strategic, and finally transformational; “only then did we realize that we were different.” Michael Saylor: You Come Into My Financial History House?! Jokes aside, Michael Saylor is very welcome to the warm waters of our financial past. He acquitted himself honorably by invoking the British Consol — though mispronouncing it, and misdating it to the 1780s; Pelham’s consolidation of debts happened in the 1750s and perpetual government debt existed well before then — and comparing it to the gold standard and the future of bitcoin. He’s right that Strategy’s STRC product in many ways imitates the consols; irredeemable, perpetual debt, issued at par, with…
Share
BitcoinEthereumNews2025/09/18 02:12