On February 26, 2026 – The Vietnam-based DeFAI Holdstation smart wallet project (built on Worldcoin and BNB Chain) confirmed it was a victim of a serious supply chain attack in the early morning of February 25, 2026. The total loss recorded is 462,000 USDT.
This is the project’s second security incident in 2026, after losing approximately $100,000 in January.
Supply Chain Attack: Not Targeting Smart Contracts but Infrastructure
According to official statements, the hacker did not directly breach user wallets or smart contracts. Holdstation and the auditing firm Verichains confirmed that the smart contracts remain secure.
Instead, the attacker targeted the application distribution infrastructure – the platform that provides updates to users.
Specifically, the hacker:
After gaining control of the infrastructure, the attacker modified the JavaScript files in the official app version, inserting malicious code as a backdoor. Users updating the app inadvertently installed the infected version.
“Silent” Withdrawal Mechanism
The malicious code is designed to activate immediately after installation:
As a result, many wallets were drained within the first few minutes after the malicious update was released.
Holdstation’s Emergency Response Within 30 Minutes
According to the timeline released (UTC+7):
Subsequently, Holdstation coordinated with Verichains to analyze on-chain data and gather evidence for the investigation.
The current confirmed total loss is 462,000 USDT.
100% Refund Commitment to Users
Holdstation commits to fully reimburse affected assets. Users are required to fill out the official form at:
https://forms.gle/9FriUzFWHx6ZPXCS7
The team will verify on-chain ownership and authenticate wallets before issuing refunds. The project emphasizes that no seed phrase, private key, or any fees are required during the reimbursement process.
Security Lessons for the Industry
The incident shows that even if smart contracts are secure, vulnerabilities in the software distribution infrastructure can cause significant losses. This type of attack is a supply chain attack – where hackers infiltrate the “entry point” of the product rather than attacking users directly.
Holdstation stated it is upgrading its entire release process, including:
This incident has attracted significant attention from the Vietnamese crypto community, as Holdstation is one of the DeFi wallet projects based in Ho Chi Minh City.
The project promises to continue updating the investigation progress in the coming days.
Vương Tiễn
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
An American man was indicted for attacking Uranium Finance, with $54 million at stake and a maximum of 30 years in prison.
March 30, U.S. prosecutors charged Jonathan Spalletta of Maryland, accusing him of repeatedly attacking the decentralized exchange Uranium Finance since 2021, involving $54 million. Spalletta faces computer fraud and money laundering charges, with a maximum total sentence of up to 30 years in prison. He allegedly profited illegally by manipulating transaction processes and used the proceeds to buy collectible items. Prosecutors emphasized that crypto assets are also protected by law.
GateNews1h ago
Malware Infiniti Stealer targets Mac users’ encrypted wallets by forging verification codes
GoPlus Security reports that a type of malware called Infiniti Stealer carries out attacks against Mac users by impersonating a Cloudflare verification page, stealing crypto wallets and credentials. The malware bypasses security mechanisms by manually executing commands; it can steal browser data and developer keys and has the ability to evade detection.
GateNews12h ago
Pi Network Scam Alert as Fake 2FA Links Target Users
A wave of scams is targeting Pi Network users during the Second Migration phase, with fake 2FA links tricking individuals into sharing wallet passphrases. Scammers exploit user urgency, leading to unauthorized wallet access. Users must prioritize security and only interact through official channels to protect their funds.
Coinfomania14h ago
Michael Saylor once again compared STRC to money market funds, sparking a retail frenzy.
Strategy company founder Michael Saylor compared his stock STRC to a money market fund on CNBC, drawing attention. STRC has a dividend of up to 11.5%, but it is not a true money market fund and carries high risks. Despite the SEC stating that its risks are significant, Saylor still attracts a large number of retail investors, and analysts remind that caution is needed to distinguish between them.
GateNews15h ago
LiteLLM Hacker Poisoning Incident: 500,000 Credentials Leaked, Cryptocurrency Wallets at Risk of Being Stolen, How to Check if You've Been Affected?
LiteLLM recently suffered a supply chain attack, resulting in the leak of hundreds of GB of data and 500,000 account credentials. The attackers exploited a vulnerability in GitHub's CI/CD to steal Trivy access credentials, subsequently inserting malicious code. This incident highlights the importance of supply chain security, and developers should enhance permission management and monitoring.
区块客15h ago
NPR Host Hacked by Crypto Scammers - U.Today
NPR host Scott Simon's X account was hijacked by cryptocurrency scammers, prompting a warning from colleague Steve Inskeep. The account has been locked to prevent further scams, highlighting a growing trend of targeting prominent journalists for fraud.
UToday15h ago
