CoinMarketCap Hacked: Fake Web3 Popup Drains Crypto Wallets in Supply Chain Attack

In a shocking cryptocurrency security breach, CoinMarketCap, the leading crypto price tracking platform, fell victim to a supply chain attack on June 20, 2025, exposing users to a malicious Web3 wallet drainer campaign. Hackers exploited a vulnerability in the site’s homepage “doodle” image, injecting malicious JavaScript to display fake wallet verification popups. This phishing scam tricked users into connecting their crypto wallets, resulting in stolen digital assets.

What Happened in the CoinMarketCap Hack?

On June 20, 2025, CoinMarketCap users encountered unauthorized Web3 popups prompting them to “verify” their wallets. These popups, powered by a malicious script from static.cdnkit[.]io, used the Inferno Drainer toolkit to drain cryptocurrency. Coinspect Security traced the attack to a compromised backend API delivering manipulated JSON payloads via the “doodles” feature. The attack impacted 110 victims, stealing $43,266 in crypto.

How Did the Hackers Execute the Attack?

The client-side vulnerability in CoinMarketCap’s front-end system allowed hackers to inject malicious code through a third-party service. The script displayed phishing popups mimicking Web3 wallet connect prompts, tricking users into approving ERC-20 token transactions. The attack’s use of social engineering and typosquatted domains made it highly deceptive.

CoinMarketCap’s Response

CoinMarketCap confirmed the breach on June 21, 2025, via X: “We’ve identified and removed the malicious code from our site. Our team is continuing to investigate and taking steps to strengthen our security.” The exploit was patched, but the incident follows a 2021 leak of 3.1 million email addresses.

The breach, alongside a Cointelegraph hack, suggests a coordinated Web3 phishing campaign. With $240 million lost to crypto hacks in May 2025, the industry needs stronger cybersecurity measures. CertiK warns of a shift to social engineering attacks, emphasizing crypto wallet safety.

The CoinMarketCap hack highlights the need for vigilance in the cryptocurrency market. By prioritizing crypto security, users can protect their digital assets in the Web3 ecosystem. Stay informed to navigate this dynamic landscape safely.