Malicious Packages Drain dYdX User Wallets in Latest DeFi Exploit
Another day, another DeFi disaster—this time targeting one of the biggest names in decentralized derivatives.
The Attack Vector: Malicious Code in Plain Sight
Security researchers flagged a series of rogue software packages masquerading as legitimate developer tools. Once installed, these packages siphoned private keys and drained connected wallets—no complex smart contract exploit needed. Just old-fashioned social engineering with a crypto twist.
dYdX's Response: Damage Control Mode
The platform's team scrambled to issue warnings across social channels, urging users to revoke unnecessary wallet permissions. But the silence on compensation talks speaks volumes—another reminder that 'code is law' usually means 'you're on your own.'
The Bigger Picture: Infrastructure Risks
This isn't about flashy bridge hacks or oracle manipulations. It's a stark reminder that the entire DeFi stack remains vulnerable, from smart contracts down to the basic developer tooling that builds them. If you can't trust your package manager, what can you trust?
One cynical finance jab: Traditional banks get bailouts; DeFi users get 'we told you to check the commit history' tweets.
The takeaway? The crypto ecosystem keeps building skyscrapers on quicksand—and wonders why the foundations keep shaking. Until security becomes more than a marketing bullet point, these stories will keep repeating like a broken record.
Malicious packages breach wallets associated with dYdX
According to the report, some of the packages that have been infected include npm (@dydxprotocol/v4-client-js):(3.4.1, 1.22.1, 1.15.2, 1.0.31 versions) and PyPI (dydx-v4-client): (1.1.5post1 version). Socket mentioned that the platform has processed more than $1.5 trillion in trading volume since it made its debut in the decentralized finance industry, with an average trading volume of $200 million to $540 million. In addition, the platform also has about $175 million in open interest.
The exchange provides code libraries that allow third-party applications for trading bots, automated strategies, or backend services, all of which involve mnemonics or private keys for signing. The npm malware embedded a malicious function in the legitimate package. When a seed phrase that underpins a wallet’s security is processed, the function copies it along with a fingerprint of the device running the application.
The fingerprint allows the threat actor to match stolen credentials to victims across several compromises. The domain receiving the seed phrases is dydx[.]priceoracle[.]site, which mimics the legitimate dYdX service at dydx[.]xyz through typosquatting. The malicious code available on PyPI continued the same credential theft function, although it implements a remote access Trojan (RAT) that allows execution of new malware on already infected systems.
The researchers noted that the backdoor received commands from dydx[.]priceoracle[.]site, adding that the domain was created and registered on January 9, 17 days before the malicious package was uploaded to PyPI. According to Socket, the RAT runs as a background daemon thread, beacons to the C2 server at a 10-second interval, receives Python code from the server, and executes it in an isolated subprocess with no visible output. In addition, it also uses a hard-coded authorization token.
New attack showcases disturbing trend
Socket added that once installed, the threat actors were able to carry out arbitrary Python code with user privileges, steal SSH keys, API credentials, and source code. In addition, they could also install persistent backdoors, exfiltrate sensitive files, monitor user activity, and modify critical files. The researchers added that the packages were published to npm and PyPI using official DYDX accounts, which meant they were compromised and used by the attackers.
While dYdX is yet to release a statement addressing the issue, this is at least the third time that it has been targeted in attacks. The previous incident occurred in September 2022 when a malicious code was uploaded to the npm repository. In 2024, the dYdX website was commandeered after the V3 website was hijacked through DNS. Users were redirected to a malicious website that prompted them to sign transactions designed to drain their wallets.
Socket claimed that this latest incident highlights a disturbing pattern of adversaries targeting dYdX-related assets using trusted distribution channels. It noted that the attackers knowingly compromised packages in the npm and PyPI ecosystems to expand the attack surface to reach JavaScript and Python developers working with the platform. Anyone using the platform should carefully examine all applications for dependencies on the malicious packages.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.
