Ethersphere's Own Tools Turned Into Wallet-Stealing Malware

Robert Moore · 2026-11-09

You know how we trust the tools we use every day? Especially when they come from a project's official channels? Well, that trust just got a serious reality check, thanks to a sneaky attack on Ethersphere's Swarm network. ### How the Attack Unfolded Attackers didn't break in through some sophisticated zero-day. Instead, they hijacked Ethersphere's own release automation to push out malicious versions of two popular tools: bee-js 13.3.0 and Swarm Desktop 0.56.2. These are legitimate tools used by developers and node operators in the Swarm decentralized storage ecosystem. The compromised releases were programmed to download and run code that steals the wallet key stored by Swarm Desktop for its node, along with the password that unlocks it. And if that wasn't enough, the malware also installs a backdoor, giving attackers persistent access to the compromised system. ### Why This Matters to You If you're running a Swarm node or using bee-js in your projects, this is a wake-up call. The attack exploited the very automation that's supposed to make releases smooth and reliable. It's a reminder that even trusted sources can be compromised. > "Supply chain attacks are insidious because they target the trust we place in software distribution. Always verify, never assume." – Robert Moore, Lead Antidetect Browser Specialist So, what can you do? First, if you've downloaded either of these versions, assume your keys are compromised. Move your funds to a new wallet immediately and scan your system for backdoors. Second, always verify checksums and signatures when downloading updates – even from official sources. And third, consider using antidetect browsers to isolate your browsing and reduce the risk of cross-contamination from malicious sites. ### The Bigger Picture This isn't just about Swarm. It's about the entire software supply chain. Attackers are increasingly targeting build and release processes because they offer a high reward for relatively low effort. As we rely more on automated systems, we need to double down on security at every step. Stay safe out there, and remember: trust, but verify.