CoinMarketCap says virus was in a “doodle image” on its homepage and “contained a link that triggered malicious code”
A hacker attack on the CoinMarketCap price indexer affected 76 cryptocurrency wallets and generated a loss of US$21,000 (R$115,000) for investors, which will be fully reimbursed by the company.
The criminals managed to apply a virus to an image on the main page and infect wallets that connected to the site's services.
The first to notice the virus was the MetaMask team, which on Friday (20th) released a public statement asking its users not to connect their wallets to the site. Immediately afterwards, CoinMarketCap confirmed that visitors should not link their addresses to the site's services, which were compromised.
Later, the indexer gave more details: the virus was in a “doodle image” on its homepage and “contained a link that triggered malicious code through an API call, resulting in an unexpected pop-up for some users.”
The security firm Coinspect Security conducted an analysis in which it states that the attack was a JavaScript injection via Lottie JSON. “We successfully reproduced a JavaScript injection vulnerability that exploits Lottie animation JSON files. The ‘CoinMarketClap doodle’ incident demonstrates this attack vector.”