Which crypto sites saw drainer exploits?

TLDR

In the past week, the most clearly confirmed drainer-style compromise was the ZEROBASE protocol website frontend; researchers also warned that a new JavaScript supply?chain flaw is enabling wallet?drainer injections across multiple crypto sites.

1. ZEROBASE protocol: its frontend was exploited on 12 Dec, with losses above $240,000 and 270+ users affected per an exchange notice.
2. Multiple sites at risk: a recent JavaScript exploit allows attackers to inject wallet?drainer scripts into crypto websites, per a security report.
3. Related approval drains: Espressos co?founder reported a $30,000 loss via a legacy Thirdweb contract approval, highlighting drainer?like theft via approvals rather than a site hack, per a news report.

Deep Dive

1. ZEROBASE Frontend

The clearest specific site hit this week was ZEROBASEs website frontend. An official incident summary says hackers exploited the frontend on 12 Dec, impacting 270+ users and causing losses above $240,000 as fake contracts tricked users into approvals and transfers, a classic drainer pattern. See the exchange notice.

• Prior to the attack, ZEROBASE warned about phishing contracts impersonating the sites interface.
• Frontend compromises often work by injecting scripts or swapping connections to malicious contracts, then surfacing deceptive signature prompts.

2. JavaScript Supply?Chain Risk

Security teams flagged a second JavaScript exploit in four months that enables unauthenticated attackers to inject wallet?drainer code into websites, including crypto sites. This widens exposure beyond a single project to any site pulling a compromised package or asset, per a security report.

1. The flaw enables remote code execution and covert insertion of drainer scripts that present deceptive pop?ups or fake rewards.
2. Admins are advised to audit for injected or obfuscated JavaScript and review flagged phishing warnings, since some compromised sites might be misidentified as phishing.
3. A parallel update noted a major JavaScript library breach putting all crypto websites at risk if they rely on affected packages, per a report.

3. Approval Drains via Legacy Contracts

While not a website compromise, Espresso co?founder Jill Gunter detailed a $30,000 USDC drain linked to a legacy Thirdweb bridge contract that retained unlimited token approvals. Attackers exploited the approval path to siphon funds, per a news report.

1. Thirdweb said the legacy contract should have been disabled in an earlier response; it has now been permanently disabled.
2. Approvals can outlive the session and expose wallets if a contract later becomes compromised or malicious.

Conclusion

This weeks specific drainer?style site compromise was the ZEROBASE frontend. Parallel reports indicate a JavaScript supply?chain vector that can inject drainer scripts across many crypto sites, expanding risk beyond any single project. Practically, verify contracts before signing, prefer minimal?scope approvals, and revisit old approvals after incidents or stack changes.