Summary
- SlowMist uncovered compromised Swarm software releases that exposed Ethereum ecosystem users to potential cryptocurrency wallet theft and unauthorized access risks.
- Hackers exploited Ethereum smart contracts to control malicious software, connecting the attack infrastructure to earlier SleepyDuck and EtherDuck malware campaigns.
- Security researchers identified wallet theft threats and advised affected users to install verified clean software versions to prevent further compromise.
Ethereum users face potential wallet security threats following a supply chain attack targeting Ethersphere’s Swarm software distribution infrastructure. Blockchain security firm SlowMist identified malicious software releases capable of stealing cryptocurrency credentials and compromising affected computers.
According to SlowMist’s security alert on X, attackers compromised GitHub accounts and exploited legitimate release processes to distribute malware. The affected software belongs to Swarm, a decentralized storage network connected to the broader Ethereum ecosystem. Researchers warned that the attack could affect Windows, macOS, and Linux users, exposing sensitive wallet information and private keys.
Also Read: XRP Ledger Payment Volume Surges 207% to 1.16 Billion XRP as Price Nears $1
Hackers Exploit Ethereum Smart Contracts to Control Malicious Software
SlowMist’s investigation revealed that attackers used Ethereum smart contracts to manage malicious software distributed through compromised Swarm releases. The malware downloads and executes harmful JavaScript while communicating with infrastructure controlled by the attackers.
Significantly, the attackers used an Ethereum smart contract as a decentralized command-and-control configuration repository for managing malicious operations. This arrangement allows attackers to modify server addresses remotely without releasing additional infected software versions.
Researchers also linked the smart contract to previous malware campaigns identified as SleepyDuck and EtherDuck. These campaigns targeted developers through malicious extensions distributed on the Open VSX marketplace. The connection suggests similarities between the attacks, particularly their reliance on blockchain infrastructure to support malicious activities.
Security Researchers Identify Wallet Theft and Persistent Access Risks
We're back on X.
— 36Crypto (@36Crypto1) August 21, 2026
Our previous account (36crypto2) is currently unavailable while we continue working through the appeal process. In the meantime, this is our new official account. While you are on this page, please support us by sharing and following.
Independent security researchers at Socket and SafeDep uncovered additional malware targeting Swarm wallet files and cryptocurrency credentials. Their findings identified malicious tools capable of stealing sensitive information and establishing persistent remote access to compromised systems.
Additionally, the attackers exploited trusted software distribution channels, increasing the possibility of users installing compromised applications without detecting malicious activity. Following these discoveries, SlowMist advised affected users to uninstall the compromised package and restore the verified clean version 13.2.0. Meanwhile, Swarm Desktop v0.56.2 users received instructions to upgrade to the clean v0.56.3 release to address identified risks.
Security researchers have not confirmed the number of affected users or established the financial losses associated with the attack. The incident demonstrates how compromised development accounts can expose cryptocurrency users to wallet theft and unauthorized system access.
