Crypto Developer Komodo 'Hacks' Wallet Users to Foil $13 Million Theft

Cryptocurrency wallet developer Komodo has effectively hacked its own customers to protect their funds from an external attack.

AccessTimeIconJun 7, 2019 at 9:33 a.m. UTC
Updated Sep 13, 2021 at 9:17 a.m. UTC

Cryptocurrency wallet developer Komodo has effectively hacked its own customers to avert an attack that could have resulted in the theft of funds worth nearly $13 million.

A blog post from the npm JavaScript package repository, first reported by ZDNet, indicated that its security system raised an alert about a backdoor on June 5 that could have been used by hackers to rob users of one of Komodo's older wallets, Agama.

An audit showed a malware threat with the potential to steal cryptocurrency wallet seeds and logins.

To prevent hackers from taking advantage of the malicious code, Komodo and npm used the same backdoor to extract Agama users' funds and transferred them to a safe location away from hackers reach.

Npm said:

"After being notified by our internal security tooling of this threat we responded by notifying and coordinating with Komodo to protect their users as well as remove the malware from npm."

In a security alert, Komodo said: "After discovering the vulnerability, our Cyber Security Team used the same exploit to gain control of a lot of affected seeds and secure the funds at risk."

Komodo said it was able to safeguard 8 million komodo (KMD) tokens and 96 bitcoin, collectively worth nearly $13 million.

To prevent hackers from using their old seeds and paraphrases in the future, the developer advised Agama wallet users to move their funds to its newer wallet products and create new KMD and BTC addresses, as well as new passphrases.

 code image via Shutterstock


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.