If you checked crypto prices on CoinMarketCap over the weekend of June 20 to 22, 2025, or browsed Cointelegraph for news, your wallet might have been at risk. Both platforms were compromised in coordinated supply chain attacks that served malicious pop-ups to visitors, attempting to drain connected crypto wallets. In total, 76 CoinMarketCap users lost a combined $21,624.47. Here is what happened and what you need to know to stay safe.
The Basics
Supply chain attacks target the trust relationships between platforms and their third-party dependencies rather than attacking the platform itself. In the CoinMarketCap incident, attackers did not hack CoinMarketCap’s servers. Instead, they compromised a third-party decorative image called a “doodle” that loaded on the homepage through an external API call.
When visitors loaded the CoinMarketCap homepage, their browsers fetched this doodle image as usual. But the API response had been tampered with to include hidden JavaScript code. This code created a realistic-looking pop-up that asked users to connect their crypto wallets. Anyone who clicked “Connect Wallet” and approved the connection had their credentials sent to attacker-controlled servers.
The Cointelegraph breach worked similarly. Attackers compromised the banner advertising system on June 21 to display a fake airdrop promotion that prompted wallet connections. Both attacks were linked to Inferno Drainer, a criminal service that provides ready-made phishing toolkits to scammers.
Why It Matters
These incidents matter because they target the most basic assumption in crypto security: that visiting a legitimate, well-known website is safe. If CoinMarketCap, which is owned by Binance and serves millions of monthly visitors, can be compromised through a third-party widget, then no platform is truly immune.
The attack also highlights a broader vulnerability. As the crypto ecosystem has grown, platforms have increasingly relied on third-party services for advertising, analytics, content delivery, and interactive features. Each of these integrations represents a potential attack surface that is outside the platform’s direct control. Bitcoin was trading at approximately $105,578 on June 23, and Ethereum was near $2,422, meaning that even casual users holding modest amounts of cryptocurrency had meaningful value at stake.
Getting Started Guide
Protecting yourself from supply chain attacks on trusted websites requires a combination of behavioral habits and technical tools. Here is what you should do starting today.
1. Use a hardware wallet for significant holdings. Hardware wallets like Ledger or Trezor store your private keys on a physical device that never exposes them to your computer’s browser. Even if a malicious script runs on CoinMarketCap, it cannot extract your private keys from a hardware wallet. Any transaction requires physical confirmation by pressing a button on the device.
2. Never connect your wallet through unexpected pop-ups. Legitimate platforms will never prompt you to connect your wallet through an overlay or pop-up that appears without you taking an explicit action. If you see a wallet connection prompt that you did not initiate, close the tab immediately.
3. Keep browser wallets locked when not in use. If you use MetaMask, Phantom, or similar browser wallets, keep them locked unless you are actively transacting. A locked wallet cannot be connected by a malicious script without your explicit interaction.
4. Use a dedicated browser profile for crypto activities. Creating a separate browser profile with only your crypto wallet extensions installed reduces the attack surface. Use this profile exclusively for DeFi interactions, and browse general websites in a different profile without wallet extensions.
5. Regularly revoke token approvals. Even if you connected your wallet to a malicious site, the damage can be limited if you revoke approvals promptly. Use tools like Revoke.cash or Etherscan’s token approval checker to review and remove any approvals you do not recognize.
Common Pitfalls
Many crypto users assume that because a website is popular and well-funded, it must be secure. The CoinMarketCap attack disproves this assumption entirely. Supply chain attacks bypass server-side security measures like firewalls and intrusion detection because the malicious code runs in your browser, not on the platform’s servers.
Another common mistake is assuming that “connecting” a wallet is a read-only operation. When you connect your wallet to a website, you grant it varying levels of access depending on what the site requests. A malicious script can request permission to spend your tokens, not just view your balance.
Users also frequently ignore the details of wallet connection prompts. Scammers rely on the fact that most people click through approval screens quickly. Taking five seconds to read what permissions a site is requesting can prevent significant losses.
Next Steps
If you visited CoinMarketCap between June 20 and 22 and connected your wallet through a pop-up, take immediate action. Revoke all token approvals granted during that period, transfer remaining assets to a new wallet address, and consider upgrading to a hardware wallet for future use. For everyone else, treat this incident as a wake-up call to review your wallet security practices. The next trusted website you visit might be the one that gets compromised.
Disclaimer: This article is for educational purposes only and does not constitute financial or security advice. Always conduct your own research and consult with security professionals regarding digital asset protection.
76 wallets drained from a doodle API response. thats like robbing a bank through the painting on the wall
serif_404 and CMC didnt even notice for hours. their bug bounty program clearly didnt cover third party assets loading on the homepage
both CMC and Cointelegraph in the same weekend. coordinated supply chain attacks are the new attack vector and nobody is ready
21k across 76 wallets is like $285 average loss per victim. low enough that nobody sues, high enough that trust in CMC popups is gone forever
a decorative image API causing wallet drains is such a specific attack vector. who audits the doodles on a price tracking site
that doodle script attack is clever but brutal, only 76 users lost money but its still bad for cmc brand.
76 users out of millions of monthly visitors. the attack surface was small but the trust damage is massive. CMC is supposed to be the safe site
285 average loss per victim. low enough that nobody files charges but high enough to destroy trust in any popup on any crypto site forever
Dan C. nobody audits third party assets because marketing teams push live changes without security review. the doodle was an API call not a static image. that decision cost 76 people their bags
popup_paranoid_ 285 average loss per victim is the sweet spot for attackers. Low enough that nobody pursues legal action, high enough to be profitable at scale
CMC gets millions of visitors a month. even a small exploit on that traffic is a systemic risk for the whole ecosystem
the Connect Wallet popup pattern is identical to every other drain attack. at some point wallet apps need to auto-block these prompts
the fact that it came through a decorative doodle API call is insane. who audits third party image endpoints on their homepage? nobody
Dan C. nobody audits third party assets because the CSP allows whatever the marketing team added last quarter. doodles should be static images not API calls
csp_violator_ a doodle being loaded via external API call instead of a static asset is the dumbest design choice. marketing teams are the real attack surface in 2025
21k total loss isnt huge compared to other hacks but coinmarketcap being compromised is a trust issue.
21k total loss is low but the real cost is every user who now hesitates before connecting a wallet on any crypto site. trust is expensive to rebuild
its not about the $21k. its about the fact that checking prices on CMC could have drained your wallet. that breaks the basic trust model
Minh T. 76 users losing 21k sounds small until you realize each one probably lost their entire bag. averages hide individual devastation
june 20 to 22 was a rough weekend for supply chain security in the crypto space.
CMC and Cointelegraph hit the same weekend with the same drainer kit. coordinated deployment not a coincidence. supply chain attacks are now industrial scale
CMC and Cointelegraph hit the same weekend means someone was shopping a supply chain exploit to multiple drainer kits. coordinated not coincidental
76 victims on CMC alone and CoinTelegraph got hit the same way the same weekend. this was a coordinated drainer kit deployment not two separate incidents