Fake Nethereum NuGet Package Used to Steal Crypto Wallets and NFTs

A recent cybersecurity incident has revealed the use of a fake Nethereum NuGet package to steal cryptocurrency wallets and NFTs from unsuspecting users. This malicious package was designed to mimic the legitimate Nethereum package, a popular .NET library for interacting with Ethereum blockchain, but contained hidden backdoors to exfiltrate sensitive wallet information. Attackers distributed the fake package through compromised or unofficial NuGet repositories, targeting developers and users who rely on Nethereum for blockchain development. Once integrated into a project, the malicious code activated to capture private keys and seed phrases, enabling attackers to gain unauthorized access to victims' crypto assets. This incident highlights the growing threat of supply chain attacks in the blockchain and cryptocurrency ecosystem. Developers are urged to verify package sources rigorously and use cryptographic signatures to ensure authenticity. Additionally, users should monitor their wallets for suspicious activity and consider hardware wallets for enhanced security. The cybersecurity community continues to emphasize the importance of secure software supply chains, especially as blockchain technology adoption increases. This case serves as a critical reminder to maintain vigilance against counterfeit packages that can compromise digital assets and personal information. In conclusion, the fake Nethereum NuGet package attack underscores the need for robust security practices in software development and cryptocurrency management. Stakeholders must collaborate to improve detection mechanisms and educate users about potential risks in the evolving threat landscape.

This Cyber News was published on thehackernews.com. Publication date: Wed, 22 Oct 2025 22:59:03 +0000


Cyber News related to Fake Nethereum NuGet Package Used to Steal Crypto Wallets and NFTs

Fake Nethereum NuGet Package Used to Steal Crypto Wallets and NFTs - A recent cybersecurity incident has revealed the use of a fake Nethereum NuGet package to steal cryptocurrency wallets and NFTs from unsuspecting users. This malicious package was designed to mimic the legitimate Nethereum package, a popular .NET ...
2 months ago Thehackernews.com
Does Your App Accept Digital Wallets? - Digital wallets are electronic systems that securely store payment information digitally. Digital wallets are designed for convenience and often include security features to protect your financial data. How Digital Wallets Function Digital wallets ...
2 years ago Feeds.dzone.com
Porsche Abruptly Halts NFT Launch, Allowing Phishing Sites to Take Advantage - Porsche abruptly cut its minting of a new NFT collection short after a dismal turnout and backlash from the crypto community, allowing threat actors to fill the void by creating phishing sites that steal digital assets from cryptocurrency wallets. ...
2 years ago Bleepingcomputer.com
CVE-2025-12194 - Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS bcprov-lts8on on All (API modules) allows ...
2 months ago
Ledger dApp supply chain attack steals $600K from crypto wallets - Ledger is warnings users not to use web3 dApps after a supply chain attack on the 'Ledger dApp Connect Kit' library was found pushing a JavaScript wallet drainer that stole $600,000 in crypto and NFTs. Ledger is a hardware wallet that lets users buy, ...
2 years ago Bleepingcomputer.com
Feds Seize 'Sinbad' Crypto Mixer Used by North Korea's Lazarus - In its continued efforts to crack down on North Korea's most formidable state-sponsored threat group, the US government has seized a virtual currency mixer that has been serving as the principal way the group launders money stolen from its ...
2 years ago Darkreading.com Lazarus Group
GrassCall scam drains crypto wallets through fake web3 job interviews - A recent social engineering campaign targeted job seekers in the Web3 space with fake job interviews through a malicious "GrassCall" meeting app that installs information-stealing malware to steal cryptocurrency wallets. Users are tricked into ...
10 months ago Bleepingcomputer.com
GrassCall malware campaign drains crypto wallets via fake job interviews - A recent social engineering campaign targeted job seekers in the Web3 space with fake job interviews through a malicious "GrassCall" meeting app that installs information-stealing malware to steal cryptocurrency wallets. Users are tricked into ...
10 months ago Bleepingcomputer.com
Malicious NuGet packages drop disruptive time bombs - Recently, security researchers uncovered a series of malicious NuGet packages that deploy disruptive time bombs targeting developers and organizations using the NuGet package manager. These packages are designed to remain dormant for a period before ...
1 month ago Bleepingcomputer.com
Netgear, Hyundai latest X accounts hacked to push crypto drainers - The official Netgear and Hyundai MEA Twitter/X accounts are the latest hijacked to push scams designed to infect potential victims with cryptocurrency wallet drainer malware. While Hyundai has already regained access to their account and has cleaned ...
1 year ago Bleepingcomputer.com
Web3 security firm CertiK's X account hacked to push crypto drainer - The Twitter/X account of blockchain security firm CertiK was hijacked today to redirect the company's more than 343,000 followers to a malicious website pushing a cryptocurrency wallet drainer. Crypto fraud sleuth ZachXBT later leaked screenshots of ...
1 year ago Bleepingcomputer.com
Check Point Research Unfolds: Navigating the Deceptive Waters: Unmasking A Sophisticated Ongoing NFT Airdrop Scam - Sophisticated Scam Targeting Token Holders: Over 100 popular projects' token holders targeted with fake NFT airdrops appearing from reputable sources. Multi-Stage Deception Uncovered: The ongoing Scam involves enticing victims to fraudulent websites ...
1 year ago Blog.checkpoint.com
Mandiant's X account hacked by crypto Drainer-as-a-Service gang - The threat actor who took over Mandiant's X social media account used it to share links, redirecting the company's over 123,000 followers to a phishing page to steal cryptocurrency. As Mandiant found during a follow-up investigation into the ...
1 year ago Bleepingcomputer.com
The Week in Ransomware - January 20th, 2023 Crypto Exchanges Under Attack - The week of January 20th, 2023 brought yet another wave of ransomware attacks targeting crypto exchanges. Crypto exchanges all around the world have been hit by a barrage of sophisticated and well-planned ransomware campaigns. From high-profile ...
2 years ago Bleepingcomputer.com
Android/SpyNote Moves to Crypto Currencies - Affected Platform: AndroidImpacted Users: Android users with mobile crypto wallet or banking applicationsImpact: Financial LossSeverity Level: Medium. It has grown into one of the most common families of malware for Android, with multiple samples, ...
1 year ago Feeds.fortinet.com
CVE-2022-50231 - In the Linux kernel, the following vulnerability has been resolved: ...
6 months ago
North Korean Hackers Use Fake Job Offers & Salary Bumps as Lure for Crypto Theft - Recent investigations have uncovered a massive operation carried out by North Korean hackers looking to steal cryptocurrency through fake job offers and salary bumps. According to recent reports, hackers have been able to trace the malicious ...
2 years ago Therecord.media
Bloomberg Crypto X account snafu leads to Discord phishing attack - The official Twitter account for Bloomberg Crypto was used earlier today to redirect users to a deceptive website that stole Discord credentials in a phishing attack. As first spotted by crypto fraud investigator ZachXBT, the profile contained a link ...
2 years ago Bleepingcomputer.com Scattered Spider
Pig Butchering: Fake Trading Apps Target Crypto on Apple, Google Play Stores - Pig Butchering scam targets crypto users with fake trading apps on Apple and Google Play Stores. These apps, found on Apple’s App Store and Google Play, and on phishing sites, are part of a Pig Butchering scam targeting cryptocurrency investors ...
1 year ago Hackread.com
New PyPI Malware Poses as Crypto Wallet Tools to Steal Private Keys - The cybersecurity researchers at Checkmarx uncovered a series of new supply chain attacks that exploited the Python Package Index (PyPI) in September 2024 using malicious packages to target cryptocurrency wallets. These packages identified as ...
1 year ago Hackread.com
PyPI Repository Found Hosting Fake Crypto Wallet Recovery Tools That Steal User Data - A new set of malicious packages has been unearthed in the Python Package Index (PyPI) repository that masqueraded as cryptocurrency wallet recovery and management services, only to siphon sensitive data and facilitate the theft of valuable digital ...
1 year ago Thehackernews.com
DPython's Poisoned Package: Another 'Blank Grabber' Malware in PyPI - Python Package Index is a platform that offers an extensive range of packages to simplify and enhance the development process. Malicious actors regularly upload phishing packages in the platform's repository aimed at delivering malware to steal the ...
1 year ago Imperva.com
Hackers Using Crypto Drainers in Sophisticated Phishing Attacks - The cryptocurrency industry has had a concerning rise in sophisticated phishing attacks. By employing a crypto wallet-draining technique, these threats are distinct in that they target a broad spectrum of blockchain networks, from Ethereum and ...
2 years ago Cybersecuritynews.com
Dozens of fake wallet add-ons flood Firefox store to drain crypto - More than 40 fake extensions in Firefox’s official add-ons store are impersonating popular cryptocurrency wallets from trusted providers to steal wallet credentials and sensitive data. Some of the extensions pretend to be wallets from ...
5 months ago Bleepingcomputer.com
Malicious Rust Crates Steal Solana and Phantom Wallets, Targeting Crypto Users - In a recent cybersecurity alert, researchers have uncovered malicious Rust crates designed to steal cryptocurrency wallets, specifically targeting Solana and Phantom wallet users. These malicious crates, disguised as legitimate software packages, are ...
3 months ago Thehackernews.com