Holdstation
- Funds lost
- $462K
- Attack type
- Access Control
- Network
- Ethereum, BNB Chain
- Category
- Other
Summary
On February 25, 2026, Holdstation suffered a 462,000 USDT supply chain attack when hackers compromised the application distribution server infrastructure via a fraudulent coding extension , injected malicious JavaScript into wallet function files, and distributed a trojanized update that silently drained user funds upon installation. Holdstation detected the breach within 2 minutes, suspended services, and committed to 100% compensation for all affected users.
Details of the Exploit
The attack began with infrastructure compromise through a malicious coding extension that stole employee session tokens to bypass MFA and gain unauthorized access to Holdstation's distribution server, CI/CD pipeline, and Google Cloud storage containing core JavaScript files. After establishing access, the attacker installed a backdoor and directly overwrote official update files on the distribution server with malicious code containing JavaScript injected into critical wallet control functions. The malware was designed as a targeted attack that activated silently only when the application was updated and executed.
When users installed the compromised update at 01:30 AM, the malware immediately accessed device secure storage and executed in complete silence (silent execution), exploiting the application's legitimate access rights to manipulate transaction signing processes without displaying confirmation requests to users. The backdoor sent malicious transaction signing commands, executed without requiring user authentication, and automatically transferred all assets to the hacker's wallet (0xcbfa60b39cfaeae475f649fb6705bd477219bf8d). Exploiter: https://etherscan.io/address/0xcbfa60b39cfaeae475f649fb6705bd477219bf8d
Source: De.Fi REKT Database. Data as of November 1, 2026.