Agama wallet dependency stole seeds

Agama was hit through its build chain, not through the Komodo blockchain. A GitHub contributor added electron-native-notify to the EasyDEX-GUI application used by Agama, then the npm package was updated with code that stole wallet seeds and passphrases.

The malicious package shipped before Agama's affected release. When users opened the wallet and entered a seed, the dependency contacted a remote server and stored the secret where the attacker could later use it. The payload was narrow and practical: steal the material that controls the coins.

npm privately notified Komodo on June 4, 2019. Komodo found that the attacker had already begun draining wallets, then used the same exposed seeds to sweep about 8 million KMD and 96 BTC into safe custody before the attacker could take them.

The response was unusual because it looked like theft until the context was known. The blockchain was not broken. The failure was dependency trust, pulled through a wallet build and converted into control over user funds.

Motive

Financial Gain

Attribution

Dependency

Cause

Malicious Dependency

Transitive

Yes

Actor

Compromised Dependency

• Update on Komodo's Agama Wallet Vulnerabilitykomodoplatform.com
• Plot to steal cryptocurrency foiled by the npm security teamblog.npmjs.org
• Malicious Package in electron-native-notifygithub.com
• Someone slipped a vuln into crypto-wallets via an NPM packagetheregister.com