SlowMist Details How a Fake Bot Was Used to Steal a Trader’s SOL

• The attacker accessed sensitive wallet information and transferred stolen crypto assets to the FixedFloat exchange.
• The attacker used both social engineering and complex technical maneuvers using JavaScript (Node.js).
• Exercising extra caution while dealing with unfamiliar GitHub projects is prudent for all crypto investors.

A memecoin trader on the Solana (SOL) network using the Pump.fun launchpad lost funds in a sophisticated attack orchestrated through GitHub. Earlier this month, a crypto investor, who is the victim, informed the SlowMist team of the attack that resulted in a loss of 0.9897 SOL, currently worth around $149 as the Solana price hovers around $151.6 on Tuesday, July 8.

According to on-chain analysis conducted by the SlowMist team, the attacker sent the stolen funds to FixedFloat, a non-custodial cryptocurrency exchange that is fully automated.

Closer Look at the Attack on the Pump.fun Trader

Following an analysis of the GitHub repositories uploaded by the attacker, the SlowMist team found out that the Solana Pump.fun bot used JavaScript (Node.js) with witty social engineering techniques.

The attacker embedded the malicious code in a differently named file and used obfuscation techniques using the jsjiami.com.v7.

The sophisticated attack method revealed the wallet details of the victim, which included sensitive information such as security keys. As a result, the attacker managed to silently siphon the funds to their wallet addresses.

“After de-obfuscation, we confirmed that this was indeed a malicious NPM package. The attacker had embedded logic within crypto-layout-utils-1.3.1to scan the victim’s local files. If it detected wallet-related content or private keys, it would upload this sensitive information to a server controlled by the attacker — githubshadow.xyz,” the SlowMist team explained.

The attacker also replicated the malicious package to their other GitHub accounts, which potentially increased the number of victims. Additionally, the attacker increased the credibility of the malicious NPM packages through inflated number of stars and forks.

A Critical Takeaway for Bot Users

The automated cryptocurrency trading has gained more traction globally through the democratization of digital assets made possible through decentralized financial (DeFi) protocols. The Pump.fun platform is not legally liable for any loss recorded through third party extension bots.

As a result, it is incumbent upon all memecoin traders seeking to automate via external bots to proceed with extra caution. Meanwhile, the existence of more memecoin launchpads, led by LetsBONK.fun will compel developers to increase their security features, potentially to detect such malicious attacks before damage is done.

Source