Hackers compromised the Windows version of DogWifTools, a tool for launching and promoting Solana meme coins that trend on Pump.fun, in a supply chain attack that drained its users’ wallets.
According to the developers, the attacker reverse engineered the software to extract a GitHub token, got into the private repository and injected a Remote Access Trojan into versions 1.6.3 to 1.6.6, each time a couple of hours after a legitimate release.
The trojanized builds dropped an updater.exe into AppData that went after cryptocurrency wallet private keys.
Community estimates put the losses above $10 million, a figure someone claiming responsibility called “completely off” without offering a better one.
Rekt published a nice follow-up noting that the victims were mostly meme coin operators who used the tool to fake trading volume.
In crypto’s eternal dance of predator and prey, the food chain wraps around faster than a leveraged position getting liquidated.