Incident highlights growing threat of wallet drainer attacks targeting blockchain builders
An Ethereum core developer has fallen victim to a cryptocurrency wallet drainer embedded in a malicious AI-powered code assistant, underscoring the rising threat of sophisticated scams targeting even the industry’s most experienced builders.
Zak Cole, a core Ethereum dev, revealed on Tuesday that his funds were stolen after installing a rogue Cursor AI extension named “contractshark.solidity-lang”. The extension, which appeared legitimate with a professional icon, polished description, and more than 54,000 downloads, secretly accessed Cole’s .env file, exfiltrated his private key, and transmitted it to an attacker’s server.
The compromised wallet was accessed for three days before the attacker drained its funds on August 10. “In 10+ years, I have never lost a single wei to hackers. Then I rushed to ship a contract last week,” Cole said, adding that the financial damage was limited to a few hundred dollars in Ether (ETH). He attributed the smaller loss to his practice of using project-specific hot wallets for testing while keeping primary holdings on hardware wallets.
Security experts warn that malicious IDE extensions are becoming a major attack vector for developers. “Fake publishers and typosquatting in extensions are being weaponized to steal private keys,” said Hakan Unal, senior security operations lead at blockchain security firm Cyvers. He recommends that builders vet extensions, avoid storing secrets in plain text, and work in isolated development environments.
This is not an isolated case. In September 2024, a wallet drainer disguised as the WalletConnect Protocol remained live on the Google Play Store for over five months, stealing more than $70,000 from unsuspecting users.
The Ethereum developer’s case serves as a reminder that security hygiene is critical, even for seasoned professionals. As wallet drainer malware becomes more accessible and polished, the need for robust protection measures across the developer community is greater than ever.
Disclaimer
This content is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency trading involves risk and may result in financial loss.