Fake Developer Sneaks Malicious Code into BitPay's Copay Wallet

The Copay wallet from crypto payments processor BitPay has been compromised by a hacker, the firm warns. An updated version has been released.

AccessTimeIconNov 27, 2018 at 10:15 a.m. UTC
Updated Dec 10, 2022 at 9:29 p.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global event for everything crypto, blockchain and Web3.Register Now

The Copay wallet from U.S.-based bitcoin payments processor BitPay has been compromised by a hacker, the firm says.

Bitpay announced Monday that it learned about the issue from a Copay GitHub reporthttps://github.com/bitpay/copay/issues/9346 indicating that a third-party JavaScript library used by the apps had been modified to load malicious code.

The malware was deployed on versions 5.0.2 through 5.1.0 of its Copay and BitPay wallet apps, and could potentially be used to capture private keys to steal bitcoin and bitcoin cash.

BitPay said:

“However, the BitPay app was not vulnerable to the malicious code. We are still investigating whether this code vulnerability was ever exploited against Copay users,”

The firm is asking users to not run or open the Copay wallet if they are using versions from 5.0.2 to 5.1.0. It has now released an updated version (5.2.0) without the malicious code for all Copay and BitPay wallet users that will be available in app stores "momentarily."

BitPay stressed: “Users should assume that private keys on affected wallets may have been compromised, so they should move funds to new wallets (v5.2.0) immediately.”

Bitpay has also advised users to not move any funds to new wallets by importing their 12-word backup phrases, since they correspond to "potentially compromised private keys.”

“Users should first update their affected wallets (5.0.2-5.1.0) and then send all funds from affected wallets to a brand new wallet on version 5.2.0, using the Send Max feature to initiate transactions of all funds,” it explained.

The attack appears to have been carried out by a supposed developer called Right9ctrl who took over maintenance of the NodeJS library from its author who no longer had time for the work, ZDNet reports. The social engineering attack occurred about three months ago when Right9ctrl was granted access to the repository, at which point they injected the malware.

Jackson Palmer, the creator of the dogecoin cryptocurrency, tweeted in response to the news: "This is one of the major issues with JavaScript-based cryptocurrency wallets with heavy up-stream dependencies coming from NPM. BitPay essentially trusted all the up-stream developers to never inject malicious code into their wallet. "

Code image via Shutterstock


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.