Solana supply chain attack contained, but users face six-figure losses
A supply chain attack on the Solana network was contained on December 3. Anza, a Solana development team, reported that an account with publish access to the solana/web3.js JavaScript library was compromised, allowing the attacker to inject malicious packages that stole private key information and drained funds from decentralized applications (dApps). Non-custodial wallets were unaffected, as they do not expose private keys during transactions. The issue was specific to the JavaScript client library and did not involve the Solana protocol itself. Some developers who updated their systems were impacted, but major projects like Phantom and Backpack confirmed they were not affected. The attack resulted in an estimated $160,000 in stolen assets, primarily in SOL, with losses reported by some investors in six figures. The incident's damage was considered limited compared to potential outcomes from more sophisticated exploits.
