On February 26, 2026 – The Vietnam-based DeFAI Holdstation smart wallet project (built on Worldcoin and BNB Chain) confirmed it was a victim of a serious supply chain attack in the early morning of February 25, 2026. The total loss recorded is 462,000 USDT.
This is the project’s second security incident in 2026, after losing approximately $100,000 in January.
Supply Chain Attack: Not Targeting Smart Contracts but Infrastructure
According to official statements, the hacker did not directly breach user wallets or smart contracts. Holdstation and the auditing firm Verichains confirmed that the smart contracts remain secure.
Instead, the attacker targeted the application distribution infrastructure – the platform that provides updates to users.
Specifically, the hacker:
After gaining control of the infrastructure, the attacker modified the JavaScript files in the official app version, inserting malicious code as a backdoor. Users updating the app inadvertently installed the infected version.
“Silent” Withdrawal Mechanism
The malicious code is designed to activate immediately after installation:
As a result, many wallets were drained within the first few minutes after the malicious update was released.
Holdstation’s Emergency Response Within 30 Minutes
According to the timeline released (UTC+7):
Subsequently, Holdstation coordinated with Verichains to analyze on-chain data and gather evidence for the investigation.
The current confirmed total loss is 462,000 USDT.
100% Refund Commitment to Users
Holdstation commits to fully reimburse affected assets. Users are required to fill out the official form at:
https://forms.gle/9FriUzFWHx6ZPXCS7
The team will verify on-chain ownership and authenticate wallets before issuing refunds. The project emphasizes that no seed phrase, private key, or any fees are required during the reimbursement process.
Security Lessons for the Industry
The incident shows that even if smart contracts are secure, vulnerabilities in the software distribution infrastructure can cause significant losses. This type of attack is a supply chain attack – where hackers infiltrate the “entry point” of the product rather than attacking users directly.
Holdstation stated it is upgrading its entire release process, including:
This incident has attracted significant attention from the Vietnamese crypto community, as Holdstation is one of the DeFi wallet projects based in Ho Chi Minh City.
The project promises to continue updating the investigation progress in the coming days.
Vương Tiễn
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Fake Police Officers Held French Couple at Knifepoint in $1M Bitcoin Robbery
Three suspects posing as police officers attacked a couple in Versailles, forcing them to transfer approximately €900,000 in Bitcoin. French authorities confirm the theft and are investigating the growing trend of violent robberies targeting crypto holders.
Decrypt5h ago
Korean inspection theft: 320 Bitcoins "found and recovered," quickly cashed out for $21.5 million to pay the national treasury
Gwangju District Prosecutors Office in South Korea recently sold 320.8 Bitcoin seized, cashing out 31.6 billion Korean Won. This batch of Bitcoin originally came from investigations into illegal gambling platforms from 2018 to 2021. Although there was an incident where Bitcoin was stolen by hackers due to a public official's mistake, the hackers later returned the Bitcoin. Authorities have conducted investigations and also discovered other cases of seized Bitcoin going missing.
区块客5h ago
French couple robbed at knifepoint by fake police during home invasion, forced to transfer approximately $1 million worth of Bitcoin
On March 10th, a French couple was attacked at home by three fake police officers armed with knives, forcing them to transfer approximately 900,000 euros worth of Bitcoin. The couple was injured and tied up, and the assailants fled. This case is the latest example of a "wrench attack" in cryptocurrency. Several similar incidents have occurred in France this year.
GateNews5h ago
National Internet Emergency Center issues OpenClaw security application risk warning, proposing four protective measures
The National Internet Emergency Center has issued a risk alert, as improper use of the OpenClaw agent has led to security vulnerabilities. Users are advised to strengthen network controls, enhance credential management, strictly regulate plugin sources, and stay updated on security updates to ensure safe application.
GateNews6h ago
Cosmos has disclosed a security vulnerability affecting some EVM Stack blockchains; the Saga chain has released a patch.
Gate News Announcement: On March 10, Cosmos Labs disclosed on the X platform that a recent security vulnerability affecting some blockchains built on Cosmos EVM Stack has been discovered. The vulnerability involves related functional modules and has impacted Layer 1 blockchains in the production environment.
GateNews6h ago
OpenClaw AI remains vulnerable after update; China Academy of Information and Communications Technology issues alert
Gate News Announcement, March 10th, experts from the China Academy of Information and Communications Technology issued a safety warning regarding the recently popular open-source AI agent OpenClaw (commonly known as "Lobster"). The experts pointed out that although the agent has been updated to the latest version and can fix known security vulnerabilities, this does not mean that all security risks have been completely eliminated. Previously, the Ministry of Industry and Information Technology's Cybersecurity Threat and Vulnerability Information Sharing Platform had issued related security risk alerts. (CCTV News)
GateNews7h ago
