TLDR
No public, authoritative list of named crypto sites has been published. Security teams report that many legitimate crypto websites were targeted via a critical React Server Components bug, CVE-2025-55182, now patched but actively exploited this week.
- The flaw enables remote code execution and has been used to inject wallet drainers into legitimate crypto websites, according to SEALs warning summarized here.
- React shipped fixes on Dec 3 for react-server-dom packages and urges immediate upgrades to patched versions per the notice reported here.
- Researchers also saw Monero miners and other payloads deployed across cloud environments, highlighting broad exploitation beyond Web3 UI code reported here.
Deep Dive
1. What Is Known
The CVE-2025-55182 React Server Components vulnerability allowed unauthenticated remote code execution, and multiple security groups observed attackers uploading crypto drainer scripts to otherwise legitimate websites. Reports emphasize that many crypto sites rely on React-based front ends, which puts users at risk when malicious JavaScript injects fraudulent signature prompts or swaps recipient addresses unnoticed by users Cointelegraph summary. SEAL explicitly warned of a big uptick in drainers uploaded to legitimate crypto websites via this exploit coverage.
React maintainers issued patches for affected server-dom packages on Dec 3 and advised fast upgrades. Framework vendors also pushed mitigations, but researchers caution that web application firewalls alone are insufficient, and code audits are necessary to remove planted assets analysis.
Treat any unpatched React RSC stack as high-risk and assume potential front-end compromise until verified clean.
2. What Is Not Known
No reputable source has published a definitive list of specific crypto sites impacted. Coverage consistently describes legitimate crypto websites and thousands of websites at risk, but names are absent, likely because disclosures occur on a per-site basis via status pages or incident posts after internal investigations conclude overview. Broad advisories urge audits before contesting phishing flags since hidden drainer assets can trigger automated blocks detail.
Rely on official notices from the sites you use. Absence of a public list does not imply safety; look for explicit upgrade or incident updates from the project or exchange.
3. Practical Safeguards Now
For users, be skeptical of unexpected signature prompts, especially permit signatures and token approvals. Verify recipient addresses in wallet pop-ups and pause if an interface looks altered or suddenly requests broad approvals SEAL guidance summarized. For projects, upgrade to the patched React versions, audit front-end bundles for unfamiliar or obfuscated assets, and review server access logs for indicators of compromise. Researchers also observed attackers deploying Monero miners alongside drainers, so check server resources and persistence mechanisms too research roundup.
Users can reduce risk by verifying every signature and limiting approvals. Teams should patch, audit, and monitor until systems are verified clean.
Conclusion
The React RSC exploit is actively abused, but there is no credible, published list of specific crypto sites hit. The reliable takeaway is process, not names: treat unpatched React stacks as high-risk, watch for official incident updates, and apply both user-level caution on signatures and project-level patching and audits supported by the reports above.
CoinsKid.Com