On February 26, 2026 – The Vietnam-based DeFAI Holdstation smart wallet project (built on Worldcoin and BNB Chain) confirmed it was a victim of a serious supply chain attack in the early morning of February 25, 2026. The total loss recorded is 462,000 USDT.
This is the project’s second security incident in 2026, after losing approximately $100,000 in January.
Supply Chain Attack: Not Targeting Smart Contracts but Infrastructure
According to official statements, the hacker did not directly breach user wallets or smart contracts. Holdstation and the auditing firm Verichains confirmed that the smart contracts remain secure.
Instead, the attacker targeted the application distribution infrastructure – the platform that provides updates to users.
Specifically, the hacker:
After gaining control of the infrastructure, the attacker modified the JavaScript files in the official app version, inserting malicious code as a backdoor. Users updating the app inadvertently installed the infected version.
“Silent” Withdrawal Mechanism
The malicious code is designed to activate immediately after installation:
As a result, many wallets were drained within the first few minutes after the malicious update was released.
Holdstation’s Emergency Response Within 30 Minutes
According to the timeline released (UTC+7):
Subsequently, Holdstation coordinated with Verichains to analyze on-chain data and gather evidence for the investigation.
The current confirmed total loss is 462,000 USDT.
100% Refund Commitment to Users
Holdstation commits to fully reimburse affected assets. Users are required to fill out the official form at:
https://forms.gle/9FriUzFWHx6ZPXCS7
The team will verify on-chain ownership and authenticate wallets before issuing refunds. The project emphasizes that no seed phrase, private key, or any fees are required during the reimbursement process.
Security Lessons for the Industry
The incident shows that even if smart contracts are secure, vulnerabilities in the software distribution infrastructure can cause significant losses. This type of attack is a supply chain attack – where hackers infiltrate the “entry point” of the product rather than attacking users directly.
Holdstation stated it is upgrading its entire release process, including:
This incident has attracted significant attention from the Vietnamese crypto community, as Holdstation is one of the DeFi wallet projects based in Ho Chi Minh City.
The project promises to continue updating the investigation progress in the coming days.
Vương Tiễn
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Fake FBI Crypto Tokens Are Being Used to Threaten Tron Users, Authorities Warn
In brief
The FBI said users on Tron are receiving tokens that claim to be from federal law enforcement.
The tokens urge recipients to immediately provide personal information or risk sanctions and asset freezes.
Although the FBI said it didn’t create the token, agents have used fake token
Decrypt57m ago
Some institutions warn that the banking industry may face a crisis similar to that of 2008
Gate News reported that on March 19, an institution issued a warning stating that the banking sector may face risks similar to the 2008 financial crisis. The warning points out that some banks are transferring cryptocurrency-related risk exposures off their balance sheets, a practice that could lead to the accumulation of systemic risks. During the 2008 financial crisis, off-balance-sheet assets and derivative risk exposures of financial institutions were among the important factors that triggered the crisis. The specific name of the institution issuing the warning and related data details have not yet been disclosed.
GateNews3h ago
Address holding 13.21 million USDT frozen
Gate News, on March 19, a cryptocurrency address holding 13,215,713 USDT (approximately $13.2165 million) was frozen. The specific reason for this large-scale fund freeze has not been disclosed, and this incident has once again drawn market attention to cryptocurrency asset security and regulatory actions.
GateNews4h ago
A CEX Commerce page requires users to input seed phrases, security researchers warn of serious security risks
A subdomain page of a certain CEX is requesting users to input their wallet mnemonic phrases, raising concerns from security researchers who view this practice as a serious risk. Analysts point out that the related help documentation has been removed, warning that the page could potentially be exploited for malicious attacks.
GateNews7h ago
Immunefi Report: Token Prices Hit Hard After Hacks, Averaging 61% Drop, With 83.9% Still Trading at Lows
Immunefi's latest security report shows that from 2021 to 2025, cryptocurrency hacking incidents have occurred frequently, with losses concentrated in a small number of major events. 191 attacks resulted in $4.67 billion in losses, with centralized exchanges accounting for 55% of losses. Following attacks, the median token price decline among 82 tokens reached 61%, and 83.9% remained below pre-attack levels. Persistent impacts include price declines and loss of user trust.
GateNews8h ago
Mini Lobster OpenClaw Goes Viral as "Hacker ATM"! Official Website Suffers Pixel-Perfect Clone Attack, Web3 Wallets Drained
The open-source AI project OpenClaw has been targeted by hackers. Recent large-scale phishing attacks aimed at developers have spread false token claim messages through GitHub's mention feature, luring users to click links and drain wallets. The founder has issued a statement warning that such behavior is fraudulent, and OpenClaw will not conduct token promotions. Additionally, there are multiple attack threats including fake installation packages and malicious plugins. Experts remind developers to remain vigilant and avoid testing plugins from unknown sources.
動區BlockTempo8h ago
