Which exploit hit crypto websites?

TLDR

The exploit was a critical React Server Components vulnerability (CVE-2025-55182) used to inject wallet?drainer scripts into legitimate crypto sites, leading to malicious prompts and approvals on trusted pages, per a recent report. See the React CVE report.

1. Attack vector: remote code execution let attackers insert malicious JavaScript into front ends of known crypto sites, enabling wallet drains via deceptive UI flows, as noted by a security write?up on the JavaScript exploit.

1. Status: the React team issued patches for affected packages and urged immediate updates to stop active exploitation, per an industry update on the incident.

Deep Dive

1. Attack Mechanics

This was a supply?chain style web exploit: a React Server Components flaw allowed remote code execution and injection of malicious scripts into otherwise legitimate crypto websites. The result was wallet drainer flows that looked like normal connect or permit prompts on trusted domains, increasing the chance of user approval on malicious transactions, as covered in the React CVE report.

What this means: Treat unexpected popups, especially permit signatures, as high risk even on familiar sites. Slow down, verify the action, and consider limiting approvals to specific tokens and amounts.

2. Patches And Residual Risk

React maintainers have released fixes for affected react?server?dom packages and urged projects to update quickly to block active exploitation. Reports also describe a rapid surge in drainer deployments via this vector, underscoring that unpatched front ends remain targets until fully remediated, according to an industry update.

What this means: If a site you use hasnt patched, you could still see malicious prompts. After any suspicious interaction, review approvals and recent signatures, and revoke unneeded permissions.

Conclusion

A React Server Components vulnerability (CVE?2025?55182) enabled remote code execution that injected wallet?drainer scripts into trusted crypto sites, turning normal prompts into traps. The maintainers shipped patches, but risk persists on unpatched sites, so user vigilance and rapid developer updates are the near?term defenses.