Ethereum Users Warned of Wallet-Stealing Malware in Swarm Software Supply Chain Attack
Ethereum users have been warned about a software supply chain attack targeting Ethersphere's Swarm distribution infrastructure, with malicious releases reportedly designed to steal cryptocurrency wallet credentials and compromise users' computers. Blockchain security firm SlowMist identified the threat after attackers gained access to GitHub accounts and abused legitimate software release processes to distribute malware.
The affected software is associated with Swarm, a decentralized storage network within the broader Ethereum ecosystem. According to SlowMist's security alert on X, the malicious releases could expose sensitive wallet information and private keys across Windows, macOS, and Linux systems.
Ethereum Swarm Attack Uses Smart Contracts to Control Malware
SlowMist's investigation found that the attackers incorporated Ethereum smart contracts into their malicious infrastructure. Rather than relying entirely on conventional centralized servers, the malware uses a smart contract as a decentralized configuration repository to retrieve command-and-control information.
 |
| Source: SlowMist's |
The malicious software downloads and executes harmful JavaScript while communicating with infrastructure controlled by the attackers. Through the smart contract, attackers can remotely change the server addresses used by the malware without having to distribute another compromised software release.
Researchers also identified connections between the infrastructure and two previously reported malware campaigns, SleepyDuck and EtherDuck. Those operations targeted developers through malicious extensions distributed on the Open VSX marketplace.
The similarities point to a recurring approach in which blockchain infrastructure is incorporated into malware operations, allowing attackers to manage malicious configurations through Ethereum smart contracts.
Researchers Identify Cryptocurrency Wallet Theft Risks
Further findings from independent security researchers at Socket and SafeDep revealed additional malicious tools targeting Swarm wallet files and cryptocurrency credentials.
The identified malware was capable of collecting sensitive information and establishing persistent remote access to compromised computers. This creates risks beyond the immediate theft of wallet credentials, as attackers could potentially maintain access to affected systems.
The incident also highlights the risks associated with trusted software distribution channels. By compromising legitimate development accounts and release processes, attackers can distribute malicious applications through channels that users may otherwise consider reliable.
SlowMist Recommends Restoring Verified Swarm Software Versions
Following the discovery, SlowMist advised affected users to remove the compromised software package and reinstall the verified clean version 13.2.0.
Users running Swarm Desktop v0.56.2 were separately instructed to upgrade to version v0.56.3, which was identified as the clean release intended to address the security risks.
These recommendations are intended to help users remove compromised software and return to verified releases. Users who may have installed affected packages should pay particular attention to the specific versions identified in the security alert.
Researchers have not established how many users were affected or confirmed the total financial losses resulting from the incident. The absence of those figures means the overall impact remains unclear.
Nevertheless, the attack demonstrates how compromised developer accounts and software distribution infrastructure can expose cryptocurrency users to private-key theft, credential compromise, and unauthorized access to their computers.
Writer: Marcus RenfieldCrypto Market Analyst & Onchain WriterMarcus Renfield covers cryptocurrency markets with a focus on onchain data, Bitcoin price action, and emerging market narratives. His writing examines how capital flows, network activity, and broader market structure influence short- and medium-term trends.He aims to provide clear, data-informed analysis for readers seeking a deeper understanding of crypto market dynamics.