Ethersphere's Own Tools Turned Against Users in Wallet-Stealing Attack

Michael Miller · 2026-11-09

Imagine this. You download an update from a project you trust, install it, and go about your day. Except that update wasn't really from them — or rather, it was, but it had been quietly poisoned somewhere along the way. That's the story with Ethersphere's Swarm tools right now, and it's a good reminder of why supply chain attacks hit different. Attackers didn't break in through some brute-force hack of a server. They used the Ethersphere project's own release automation to push out malicious versions of two tools: bee-js 13.3.0 and Swarm Desktop 0.56.2. Both are part of the Swarm decentralized storage network ecosystem. So the packages looked official, signed, and legitimate — because on the surface, they were. ### What the Malicious Versions Actually Do Once installed, both releases reach out and run code designed to do two ugly things. - Steal the wallet key that Swarm Desktop stores for its node - Grab the saved password that unlocks that key - Install a backdoor on the machine for good measure That combination is nasty. A wallet key alone is bad. A wallet key plus the password that unlocks it is a clean sweep. And a backdoor means the attacker doesn't just leave with your funds — they keep a door open for later. ### Why the Release Pipeline Is the Weak Point Here's the thing people miss. Most of us assume a compromise means someone smashed through the front door. In reality, the release pipeline is often the softest target. If an attacker can touch the automation that builds and publishes packages, they don't need to hack every user individually. They just wait for the update to roll out. As one security researcher put it: *"You can audit every line of code and still get burned if the thing that ships your code is compromised."* That's not paranoia. That's the new normal. If you've already installed bee-js 13.3.0 or Swarm Desktop 0.56.2, treat that machine as compromised. Rotate any wallet keys that touched it. Change stored passwords. And check for anything that looks like an unexpected background process or startup item. ### The Bigger Lesson for Anyone Running Multiple Accounts This is where antidetect browser users should pay attention. A lot of you are managing multiple profiles, sessions, and sometimes wallets across different environments. A backdoor that grabs stored credentials doesn't care whether it's a crypto wallet or a saved login for a store account. It takes what's there. So the practical takeaway isn't "avoid open-source tools." It's this: - Verify checksums and release signatures before installing updates, especially for tools that touch wallets - Isolate high-value activity from everyday browsing - Never store wallet keys and unlock passwords on the same machine if you can avoid it - Watch project channels for advisories when a supply chain incident breaks Ethersphere will presumably patch and reissue. But the window between a bad release going live and users noticing is where real damage happens. Stay sharp out there — and double-check what you installed this week.