TrapDoor malware steals crypto wallets and keys

TLDR

TrapDoor is an active malware campaign that steals crypto wallets and keys by hiding inside developer packages and even abusing AI coding tools.

1. Security firms report TrapDoor in at least 34+ malicious packages and 384 versions across npm, PyPI, and Rust, targeting crypto and AI developers to steal wallets, SSH keys, and cloud credentials.
2. The malware specifically hunts crypto wallet data from services linked to Coinbase, Binance, MetaMask, Brave, Solana, Sui, Aptos and more, plus GitHub tokens and AWS keys.
3. Developers and advanced users can reduce risk by tightening supply chain security, segregating wallets from dev machines, using hardware wallets, and rotating potentially exposed keys.

Deep Dive

1. Scope Of The TrapDoor Campaign

Security platform Socket and others describe TrapDoor as an ongoing supply chain attack focused on developers in cryptocurrency, DeFi, AI, and security infrastructure, not random retail users. Reports show more than 34 malicious packages and over 384 versions published to npm, PyPI, and Crates.io in coordinated waves, making the campaign harder to spot early. These packages masquerade as security tools or blockchain utilities such as wallet security checkers and Sui or Move build helpers, so developers may install them as routine dependencies without extra scrutiny.

Confidence: high because multiple independent security teams have analyzed the same package set and behaviors.

2. How TrapDoor Steals Wallets And Keys

Once installed, TrapDoor packages execute through normal ecosystem hooks, such as npm postinstall scripts, Python imports, or Rust build scripts, then scan the system for high value secrets. Researchers say it targets:

1. Crypto wallet data and keystores linked to services such as Coinbase, Binance, MetaMask, Brave, Solana, Sui, and Aptos.
2. SSH keys, AWS or other cloud credentials, GitHub tokens, browser stored passwords, and environment variables.
3. AI coding assistants like Claude and Cursor by dropping files such as `.cursorrules` or `CLAUDE.md` that instruct the assistant to run fake security scans which actually exfiltrate secrets.

Stolen data is then exfiltrated to attacker controlled servers, giving them potential access to both personal wallets and production infrastructure.

3. Practical Defense Steps For Crypto Users

TrapDoor mainly targets developer environments, but the impact can reach any crypto holder if developers or team infrastructure are compromised. Key defenses include:

1. Treat package installs as a security event: pin dependencies with lockfiles, avoid obscure security tools, and prefer well known libraries with active maintainers.
2. Keep signing keys and major funds off dev machines: use hardware wallets for long term holdings and avoid storing seed phrases or raw private keys on laptops or in password managers on the same device.
3. Harden accounts and rotate secrets: enable multi factor authentication on exchanges and GitHub, rotate SSH keys, cloud credentials, and API keys if you have used affected ecosystems or suspicious packages recently.

Conclusion

TrapDoor confirms a clear trend where attackers compromise software supply chains and AI tooling to reach crypto wallets and infrastructure indirectly, instead of only attacking protocols or exchanges. For everyday users this reinforces the value of hardware wallets and minimal key exposure on general purpose machines, while developers need to treat dependencies, AI assistants, and configuration files as critical security surfaces, not convenience tools alone.