Crypto Scam Alert! New Fake GitHub Trading Bot Is Draining Solana Wallets

Hold onto your wallets, folks! A brand-new crypto scam is making waves, and this time, it’s hiding in plain sight—on GitHub! Yup, you heard it right! 😱

Cybersecurity gurus at SlowMist have issued a warning after a user thought they were downloading a legitimate Solana trading bot. Spoiler: it wasn’t. Instead of helping with token trades, it helped itself to their wallet. Smooth, right? 😏

So, here’s your crash course on how NOT to lose your crypto fortune. You’re welcome. 🤑

Innocent Bot, Sinister Secret

This poor user thought they were downloading a cool “solana-pumpfun-bot” from GitHub. Sounds fun, right? Wrong! The bot seemed like the real deal—stars, forks, and even recent updates. But BAM! Wallet drained. 💸

Here’s the twist. The bot was a Node.js app with a sneaky little secret: it included a hidden dependency linked from a custom GitHub URL, not the official NPM registry. That made it slip through security checks like a greased weasel. 🐾

Once that shady code was installed, it went full-on detective mode, searching for wallet data and sending the victim’s private keys straight to the bad guys. Bye-bye crypto! 👋

GitHub Popularity? Just Smoke & Mirrors

To make it look legit, the hacker went all out—creating fake GitHub accounts to star and fork the project. It looked so safe, you’d be tempted to wear a helmet just to visit! 🧠

But hold on—here’s the kicker: the whole project had only been uploaded THREE weeks ago. Hmmm, something smells fishy. 🐟

SlowMist tweeted about it, explaining:

“The perpetrator disguised a malicious program as a legit open-source project… users unknowingly ran a Node.js project with embedded malicious dependencies, exposing their private keys and losing assets.”

On July 2, a victim reached out to the SlowMist team after losing crypto assets. The cause? Running a seemingly legitimate GitHub project — zldp2002/solana-pumpfun-bot.

What looked safe turned out to be a cleverly disguised trap.

Our analysis revealed:

1⃣The perpetrator…

— SlowMist (@SlowMist_Team) July 4, 2025

Attention, Devs and Traders: This Is Your Wake-Up Call!

SlowMist is screaming from the rooftops: Don’t trust GitHub projects just because they look shiny and new! Especially if they ask for wallet access or deal with your private keys. Don’t be a hero—test stuff in a sandbox, NOT with your real crypto. 🚫

“If you must test them, do so in a sandboxed, isolated environment with no sensitive data,” SlowMist wisely warned.

Why You Should Care

As more traders and developers flock to the open-source playground, scams like this are popping up faster than you can say “blockchain.” The takeaway? If a GitHub project wants access to your wallet, it’s more dangerous than a high-speed chase with a ninja on a skateboard. 🛹

Read More

2025-07-04 15:02