Solana Trader Loses $149 in Sophisticated GitHub Attack on Pump.fun Platform

• A Solana trader lost $149 when malicious code hidden in a fake trading bot stole their wallet credentials through GitHub. 

• The attacker used obfuscated JavaScript to scan for private keys and uploaded stolen data to their server. 

• Users should verify third-party trading tools carefully, as automated trading platforms disclaim responsibility for such losses.

A memecoin trader lost 0.9897 SOL tokens worth approximately $149 in a complex cyberattack that exploited GitHub repositories and malicious NPM packages. The incident, which targeted a user of the Solana-based Pump.fun launchpad, demonstrates the growing security risks facing automated cryptocurrency trading.

The SlowMist security team investigated after the victim reported the attack earlier this month. On-chain analysis revealed that the stolen funds were transferred to FixedFloat, a non-custodial cryptocurrency exchange known for its automated operations.

Malicious Code Hidden in NPM Package

The attacker created a sophisticated trap using JavaScript and Node.js technology. They embedded malicious code within a package called crypto-layout-utils-1.3.1, disguising it as a legitimate trading bot for the Pump.fun platform.

The malicious code was obfuscated using jsjiami.com.v7 techniques, making detection difficult for unsuspecting users. Once installed, the package scanned victims’ local files, searching for wallet-related content and private keys.

When sensitive information was detected, the malware automatically uploaded the data to a server controlled by the attacker at githubshadow.xyz. This allowed the cybercriminal to access victims’ wallet credentials and transfer funds without authorization.

The attacker enhanced the credibility of their malicious packages by artificially inflating GitHub stars and forks. They also distributed the harmful code across multiple GitHub accounts, potentially expanding their victim pool.

Rising Threats in Automated Trading

The incident highlights significant security challenges in the growing automated cryptocurrency trading sector. Pump.fun, like many decentralized platforms, disclaims liability for losses caused by third-party trading bots and extensions.

This attack method represents a concerning trend where cybercriminals exploit the popularity of memecoin trading tools. Many traders rely on automated bots to execute rapid transactions on volatile assets, creating opportunities for malicious actors.

Security experts warn that similar attacks may become more common as automated trading gains popularity. The decentralized nature of platforms like Pump.fun makes implementing comprehensive security measures for third-party integrations difficult.

Platform Competition and Security Implications

The emergence of competing launchpads, including LetsBONK.fun, may drive improvements in security features. Market pressure could force developers to implement better detection systems for malicious bot integrations.

However, the responsibility for security remains largely with individual traders. Users must exercise extreme caution when downloading and installing third-party trading tools, especially those requiring access to wallet credentials.

The attack serves as a reminder that while DeFi platforms offer unprecedented trading opportunities, they expose users to sophisticated cybersecurity threats. Traders should verify the authenticity of any automated tools before installation and avoid packages from unverified sources.