On February 26, 2026 – The Vietnam-based DeFAI Holdstation smart wallet project (built on Worldcoin and BNB Chain) confirmed it was a victim of a serious supply chain attack in the early morning of February 25, 2026. The total loss recorded is 462,000 USDT.
This is the project’s second security incident in 2026, after losing approximately $100,000 in January.
Supply Chain Attack: Not Targeting Smart Contracts but Infrastructure
According to official statements, the hacker did not directly breach user wallets or smart contracts. Holdstation and the auditing firm Verichains confirmed that the smart contracts remain secure.
Instead, the attacker targeted the application distribution infrastructure – the platform that provides updates to users.
Specifically, the hacker:
After gaining control of the infrastructure, the attacker modified the JavaScript files in the official app version, inserting malicious code as a backdoor. Users updating the app inadvertently installed the infected version.
“Silent” Withdrawal Mechanism
The malicious code is designed to activate immediately after installation:
As a result, many wallets were drained within the first few minutes after the malicious update was released.
Holdstation’s Emergency Response Within 30 Minutes
According to the timeline released (UTC+7):
Subsequently, Holdstation coordinated with Verichains to analyze on-chain data and gather evidence for the investigation.
The current confirmed total loss is 462,000 USDT.
100% Refund Commitment to Users
Holdstation commits to fully reimburse affected assets. Users are required to fill out the official form at:
https://forms.gle/9FriUzFWHx6ZPXCS7
The team will verify on-chain ownership and authenticate wallets before issuing refunds. The project emphasizes that no seed phrase, private key, or any fees are required during the reimbursement process.
Security Lessons for the Industry
The incident shows that even if smart contracts are secure, vulnerabilities in the software distribution infrastructure can cause significant losses. This type of attack is a supply chain attack – where hackers infiltrate the “entry point” of the product rather than attacking users directly.
Holdstation stated it is upgrading its entire release process, including:
This incident has attracted significant attention from the Vietnamese crypto community, as Holdstation is one of the DeFi wallet projects based in Ho Chi Minh City.
The project promises to continue updating the investigation progress in the coming days.
Vương Tiễn
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Ledger Donjon Finds MediaTek Flaw Exposing Android Wallet Seeds
_Ledger Donjon exposed a MediaTek vulnerability that extracts Android wallet seed phrases in under 45 seconds, affecting millions of devices. CVE-2025-20435._
Ledger Donjon has uncovered a serious MediaTek vulnerability. It lets attackers pull wallet seed phrases from Android phones in seconds.
LiveBTCNews2h ago
Authorities Freeze $3.5M in Crypto as Europol, DOJ Disrupt ‘SocksEscort’ Proxy Network
In brief
Europol and partners announced the disruption of the “SocksEscort” malicious proxy service and the freezing of $3.5 million in cryptocurrency linked to the operation.
The network allegedly compromised more than 369,000 routers and IoT devices and offered customers more than 35,000 p
Decrypt2h ago
CertiK Report: Cryptocurrency ATM Fraud Losses Reach $330 Million in 2025, AI Technology Escalates Criminal Sophistication
CertiK released a report showing that cryptocurrency ATM fraud losses in the United States reached $330 million in 2025, with a 33% increase. Fraud tactics are gradually escalating, with elderly people becoming the primary targets. AI-driven fraud has 4.5 times the profitability of traditional methods, and the threat from transnational criminal organizations continues to rise.
GateNews7h ago
China AI Industry Development Alliance Continuously Tracks OpenClaw Security Risks, Compiles Enterprise-Level Deployment Risk Management Guidelines
Gate News reports that on March 12, the China Artificial Intelligence Industry Development Alliance is continuously tracking the security risk dynamics of OpenClaw and compiling an enterprise-level OpenClaw deployment risk management guide.
GateNews7h ago
Tencent Launches OpenClaw Security Toolbox to Address Security Challenges of Lobster AI Agent
Tencent launched the OpenClaw Security Toolkit on March 12th to address security challenges brought by AI Agents, providing multi-layered protection for enterprises and users. The toolkit includes security solutions for cloud and personal computers, supporting environment isolation and monitoring of anomalous instructions.
GateNews7h ago
Bonk.fun Hack Exposes Solana Users to Wallet Drainer Attack
Security experts discovered malicious code on Bonk.fun that exposed users to potential wallet-draining attacks.
However, security experts have expressed fears that users of decentralized sites remain
TheNewsCrypto9h ago
