A critical vulnerability in React Server Components known as React2Shell, tracked as CVE-2025-55182 with a maximum CVSS severity score of 10.0, is being actively exploited in a coordinated campaign targeting Web3 users. Security firm Blockaid reported on January 7, 2026, that a single threat actor has compromised dozens of legitimate websites to inject wallet-draining malicious code, highlighting the growing intersection between traditional web vulnerabilities and cryptocurrency theft.
The Threat Landscape
The React2Shell vulnerability affects React versions 19.0.0 through 19.2.0 and was publicly disclosed on December 3, 2025. Exploitation activity began almost immediately, with over 4,100 exploitation attempts observed within the first two hours of disclosure. The flaw enables unauthenticated remote code execution through React Server Components, giving attackers the ability to inject arbitrary JavaScript into the front-end of any website running vulnerable React versions.
What makes this particularly dangerous for the crypto community is how the attacker weaponized a standard Web2 framework vulnerability to target Web3 users. The compromised websites span diverse verticals including health, gaming, dashboards, and small business sites, suggesting the attacker used automated scanners rather than targeting specific crypto-related domains. Bitcoin traded at approximately $93,700 on January 6 as the crypto market absorbed news of yet another security threat.
Core Principles
The attack follows a clear pattern. First, the threat actor identifies websites running vulnerable React versions using automated scanning tools. Once a target is found, the React2Shell vulnerability is exploited to inject malicious JavaScript directly into the website’s front-end. When users visit these compromised but otherwise legitimate sites, the injected script automatically triggers wallet connection prompts.
Users who interact with these prompts are exposed to wallet drainer transactions that can drain their crypto holdings. Blockaid’s on-chain analysis indicates theft of more than $10,378 in native assets since December 10, 2025, with an average loss of approximately $188 per transaction. The attacks span multiple EVM-compatible chains including Ethereum, BSC, Polygon, Arbitrum, Avalanche, and Base.
The attack demonstrates a fundamental security principle: the weakest link in any crypto security chain is often not the blockchain itself but the surrounding web infrastructure. Even sophisticated crypto users can be caught off guard when a trusted, non-crypto website suddenly displays a wallet connection prompt.
Tooling and Setup
Protecting against React2Shell requires action at both the infrastructure and user levels. Developers must immediately update React packages to patched versions: react-server-dom-webpack to version 19.0.1, 19.1.2, or 19.2.1; react-server-dom-parcel and react-server-dom-turbopack to version 19.0.1 or later. For Next.js applications, updates to versions 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7 for the 15.x branch, or 16.0.7 for the 16.x branch are required.
For end users, wallets integrated with Blockaid’s End User Protection system are already defended against this campaign. Protected platforms include major wallets such as Coinbase, MetaMask, Ledger, Trezor, Zerion, Trust Wallet, Backpack, Tangem, and Gemini, which provide real-time alerts preventing users from signing malicious transactions.
Users should also consider browser extensions that block unauthorized JavaScript execution and maintain updated antivirus software. Hardware wallets provide an additional layer of protection by requiring physical confirmation of transactions.
Ongoing Vigilance
The React2Shell campaign illustrates a broader trend in crypto security threats. As the blockchain ecosystem matures, attackers increasingly exploit vulnerabilities in the traditional web stack rather than attempting to break cryptographic primitives or smart contract logic directly. This shift means that crypto security is no longer just about auditing smart contracts; it extends to every piece of web infrastructure that users interact with.
The timing of this campaign is notable, coming just days after the Flow blockchain’s $3.9 million Cadence exploit and the BtcTurk $48 million hot wallet breach on January 1. Together, these incidents paint a picture of an increasingly sophisticated threat landscape entering 2026, where attacks range from deep protocol-level vulnerabilities to broad-spectrum web infrastructure compromises.
Final Takeaway
The React2Shell campaign serves as a stark reminder that crypto security extends well beyond the blockchain itself. Every website, every dependency, and every software library in the chain of interaction between users and their crypto assets represents a potential attack vector. Users should be wary of unexpected wallet connection prompts on websites that do not typically require them, even if the site is well-known and legitimate. Developers must treat framework updates as critical security maintenance, not optional upgrades. In a market where Bitcoin trades near $94,000 and Ethereum above $3,200, the stakes of web security failures have never been higher.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any financial decisions.
4100 exploitation attempts in the first 2 hours is insane. react 19.0.0-19.2.0 had zero chance once CVE-2025-55182 went public
CVSS 10.0 and 4100 exploitation attempts in 2 hours. if your dapp frontend runs on React 19 you need to update yesterday
Blockaid identified a single threat actor behind the whole campaign. one group had a list of dapp frontends running vulnerable React 19 and methodically injected wallet drainers into each one
sigsegv_42 exactly. 4100 attempts in 2 hours was not scanning, it was a targeted list. someone had the dapp inventory mapped before the CVE even went public
this is why i keep telling people to use hardware wallets even for just browsing. a compromised site can drain metamask in seconds
hardware wallets protect signing but compromised sites can still spoof transaction details on screen. the real fix is domain pinning and updating your react deps
domain pinning is underrated advice. most users never check if theyre on the real site vs a lookalike. updating React deps helps but the social engineering layer is where people actually get rekt
patch_me domain pinning works but 4100 attempts in 2 hours means most dapp users got hit before they could react
over 4100 attempts in 2 hours and someone was running this as a coordinated campaign against web3 specifically. not random scanning
^ exactly. single threat actor weaponizing a web2 CVE for wallet drains. the cross-domain attack surface is what makes this scary
4100 attempts in 2 hours and all targeting web3 wallets specifically. this wasnt opportunistic scanning, someone had a list of dapp domains and was working through it systematically
react 19.0.0 to 19.2.0 with cvss 10.0 disclosed dec 3 2025. wallet draining code on compromised sites is the new attack vector
CVE-2025-55182 scoring 10.0 and targeting react server components specifically. if you run any SSR with react 19.x check your dependencies immediately
the scary part about CVE-2025-55182 hitting SSR specifically is that the exploit runs server-side before the payload even reaches the client. by the time the user sees anything the RCE chain has already executed and the injected script is sitting in the rendered HTML. react server components were supposed to reduce client-side attack surface and ironically they just created a bigger one on the server.
stack_defender ssr exploit running server side before client payload arrives is terrifying. react 19 rce with zero user interaction
4100 exploitation attempts in 2 hours targeting web3 wallets specifically. whoever ran this campaign had a pre-built list of dapp domains and just worked through them
what gets me is how this blurs the line between web2 infrastructure and web3 targeting. a decade ago CVE campaigns were about defacing sites or mining crypto. now the crypto IS the target and the exploit chain goes from a compromised npm dependency all the way to your browser extension prompting a signature. the attack surface just keeps getting wider and most dapp teams dont even have someone monitoring NVD alerts.