Cybersecurity Alert: Atomic and Exodus Wallets Compromised by Malicious npm Package

Users of the popular Atomic and Exodus cryptocurrency wallets are facing a significant cybersecurity threat as researchers uncover a malicious npm package designed to hijack crypto transactions. This exploit, which masquerades as a legitimate PDF conversion tool, has raised alarms about the growing risks associated with software supply chain attacks in the cryptocurrency sector.

Key Takeaways

• A malicious npm package named pdf-to-office targets Atomic and Exodus wallets.

• The package swaps recipient wallet addresses, redirecting funds to attackers.

• Users must completely uninstall and reinstall affected wallets to remove the threat.

• This incident highlights the increasing sophistication of cyberattacks in the cryptocurrency space.

Overview of the Exploit

The malicious package, pdf-to-office, was first published on March 24, 2025, and has since been updated multiple times. It appears to be a utility for converting PDF files to Microsoft Word documents but contains hidden malicious code that targets specific versions of the Atomic and Exodus wallets.

Upon installation, the package checks for the presence of wallet files on the user's system. If detected, it overwrites legitimate files with trojanized versions that alter the destination addresses for outgoing cryptocurrency transactions. This means that when users attempt to send funds, they may inadvertently send them to the attackers' wallets instead.

The malicious code contained in the pdf-to-office package: ReversingLabs

Attack Mechanism

1. Installation of Malicious Package: Users download the pdf-to-office package, believing it to be a legitimate tool.

2. Code Injection: The package injects malicious code into the wallet software, specifically targeting files associated with Atomic Wallet and Exodus.

3. Address Swapping: The malware modifies the outgoing transaction addresses, redirecting funds to the attackers.

4. Persistence: Even if the malicious package is removed, the trojanized files remain, continuing to compromise the wallet's functionality.

Targeted Wallet Versions

The attack specifically targets:

• Atomic Wallet: Versions 2.91.5 and 2.90.6

• Exodus Wallet: Versions 25.13.3 and 25.9.2

This targeted approach indicates a high level of sophistication, as the attackers have tailored their methods to ensure maximum impact on users of these specific versions.

Implications for Users

The implications of this exploit are severe. Users who have installed the pdf-to-office package must take immediate action to protect their funds. The only effective remediation is to completely uninstall the affected wallet software and reinstall it from official sources. This ensures that any trojanized files are removed and that the wallet is restored to its original, secure state.

Conclusion

This incident serves as a stark reminder of the vulnerabilities present in the software supply chain, particularly within the cryptocurrency industry. As cybercriminals continue to develop more sophisticated methods to exploit these weaknesses, users must remain vigilant and proactive in securing their digital assets. Regularly updating software, monitoring for suspicious activity, and understanding the risks associated with third-party packages are essential steps in safeguarding against such attacks.

Sources

• Malicious npm Package Targets Atomic Wallet, Exodus Users by Swapping Crypto Addresses, The Hacker News.

• Hackers target Atomic and Exodus crypto wallets​, Cybernews.

• Atomic, Exodus wallets targeted in new cybersecurity exploit, Cointelegraph.

• npm Malware Targets Atomic and Exodus Wallets to Hijack Crypto Transfers, Hackread.

• Atomic and Exodus Wallets Targeted by Trojanized npm Package, TechNadu.

This article was created with support from AI-driven technology, drawing on multiple reputable sources. The final content has been thoroughly reviewed and edited by BlockzHub's editorial team to ensure accuracy, clarity, and coherence. Original reporting sources are credited whenever appropriate and as required. The opinions expressed in this article do not necessarily represent the official views or positions of BlockzHub. This article is intended for informational purposes only and should not be considered financial or professional advice. Investing involves risk, and you should consult a qualified financial advisor before making any investment decisions.