Two separate security failures in the crypto ecosystem have exposed wallet private keys and drained funds, again highlighting risks in trusted software supply chains and shared authentication infrastructure.
On November 9, hackers took over Ethersphere’s software release system and distributed malware through bee-js 13.3.0 and Swarm Desktop 0.56.2. The malicious code searched for Bee node wallet private keys by locating config.yaml and data-dir/keys/swarm.key. With both files, attackers could unlock and control affected Bee node wallets. The bee-js package remained on npm for about 75 minutes, while the Swarm Desktop release stayed online for almost eight and a half hours.
Cybersecurity firm Socket confirmed the compromised software appeared legitimate: bee-js had valid SLSA provenance and the Swarm Desktop macOS installer was Apple-notarized. StepSecurity found that attackers modified scripts/generate-version.cjs to download payloads from api.frameworkmetrics[.]xyz. The malware also installed backdoors, using ScreenConnect on Windows and masquerading as Solidity development tools on Linux and macOS. Socket linked the operation to compromised GitHub accounts including the release bot bee-worker, and to Ethereum contract 0xf8a900Db50b3331be6B768bA460BB59f3E40C344, previously tied by Pluto Security to the SleepyDuck and EtherDuck campaigns.
Ethersphere identified both releases as malicious. Maintainer darkobas2 said version 0.56.2 “was built and published by an attacker using stolen CI credentials.” The clean replacement, 0.56.3, was described as the same code as 0.56.1 with a new signing certificate. Users were advised to update, isolate and rebuild infected machines, move funds from clean devices, and rotate credentials. Socket recorded 65 downloads of the tainted Desktop release by 08:27 UTC on November 9 and estimated about ten bee-js 13.3.0 fetches, though no confirmed victim count or stolen-fund total exists.
On November 10, Web3Auth confirmed a security issue in its wallet authentication infrastructure affecting certain embedded Keplr wallets, mainly those created via Google or Apple login. Web3Auth suspended its embedded wallet service and began recovery work, while Keplr told users not to deposit funds into flagged accounts. Blockchain analytics firm Bitquery estimated attackers drained at least $6 million from more than 44,000 wallets across eight Cosmos networks, including Cosmos Hub, Osmosis, Celestia and Injective.
Trust Wallet said its users were not affected, and MetaMask said it had no evidence of affected users but continued monitoring. The incidents add to a string of recent failures: Binance reportedly faced a breach around $6.3 billion on October 29, Bitget was exploited for about $387.5 million in September, and KelpDAO lost around $290 million earlier in 2026. No proven link exists between the Web3Auth exploit and wider market declines in Bitcoin or Ethereum. CoinGecko priced BZZ near $0.0654 on November 10, with no confirmed breach-driven selloff.
