A critical vulnerability disclosed on January 4, 2025 in iTerm2, one of the most popular terminal emulators for macOS, has reignited concerns about endpoint security for cryptocurrency users and developers. The flaw, tracked as CVE-2025-22275, affects versions 3.5.6 through 3.5.10 and allows remote attackers to read sensitive information from terminal sessions, including commands, private keys, and wallet credentials typed by users. With Bitcoin hovering near $98,200 and Ethereum around $3,650, the stakes for crypto practitioners who manage assets through terminal interfaces have never been higher.
The Threat Landscape
The iTerm2 vulnerability stems from the SSH Integration feature, which writes terminal output to a temporary file at /tmp/framer.txt. This file can be read by any local process running under the same user account, meaning that malware or malicious scripts already present on a system could silently harvest everything displayed in the terminal, including private keys, seed phrases, API tokens, and wallet passwords. For crypto developers who regularly interact with node software, deploy smart contracts, or manage server-side wallet operations through SSH sessions, this represents a serious exposure vector. The vulnerability is particularly insidious because it requires no special privileges — any code running under the user account can access the file.
The broader context is even more concerning. Terminal emulators are foundational tools in the crypto ecosystem. Developers use them to interact with blockchain nodes via command-line interfaces, manage deployment scripts, and execute wallet operations. A compromise at the terminal level bypasses virtually all downstream security measures, including hardware wallets and multi-signature setups, because the attacker captures the data before it reaches any secure enclave.
Core Principles
Securing your terminal environment starts with understanding the principle of least privilege. Every application running on your system should have only the minimum permissions necessary to function. The iTerm2 flaw demonstrates what happens when a convenience feature — SSH Integration — creates an unintended data leakage path. The fix, available in iTerm2 version 3.5.11, removes the vulnerable temporary file mechanism, but the incident offers broader lessons.
First, always keep terminal software updated. Security patches for developer tools often go unnoticed amid the noise of operating system updates and application upgrades. Second, audit your SSH configuration. Disable unused integration features, and consider whether features like automatic profile switching or shell integration are worth the additional attack surface. Third, use dedicated security-focused terminal configurations for crypto operations, separate from general-purpose browsing and development work.
Tooling and Setup
For crypto-specific workflows, consider these security hardening measures. Use a dedicated user account for crypto operations with restricted file permissions, preventing other applications from accessing sensitive data. Configure your shell to clear the command history for sensitive sessions or use export HISTIGNORE="*" before entering private keys or seed phrases. Employ SSH agent forwarding with caution, and never forward agents to untrusted hosts.
Hardware security keys like YubiKey can add a second factor to SSH authentication, preventing unauthorized access even if credentials are compromised. For wallet management, use air-gapped signing workflows where the machine holding private keys never connects to the internet. Tools like gpg-agent or dedicated HSM devices provide hardware-level protection for cryptographic operations.
Ongoing Vigilance
Security is not a one-time setup — it requires continuous attention. Monitor security advisories for all developer tools in your stack, not just the obvious ones. Subscribe to CVE databases and vendor security mailing lists. Implement file integrity monitoring on critical directories, especially /tmp and other world-writable locations. Regularly audit running processes and open file descriptors to catch unexpected data access patterns.
The iTerm2 vulnerability also highlights the importance of compartmentalization. By isolating crypto operations from general computing activities — using separate virtual machines, containers, or even dedicated hardware — you limit the blast radius of any single vulnerability. A flaw in your terminal emulator should never be able to reach your wallet keys.
Final Takeaway
The CVE-2025-22275 vulnerability is a wake-up call for anyone who manages cryptocurrency through terminal interfaces. The convenience of SSH Integration and shell features must be weighed against the security implications of exposing sensitive data to local processes. Update iTerm2 to version 3.5.11 or later immediately, audit your terminal configurations, and implement the layered security measures described above. In crypto, your terminal is the gateway to your assets — treat it with the same security rigor you apply to your wallets and exchanges.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research and consult security professionals for critical infrastructure decisions.
writing session output to tmp framer txt at 98k BTC price is insane. one malicious npm postinstall script and every key you typed for months is exfiltrated
ssh integration writing to /tmp/framer.txt at 98k btc price is genuinely terrifying. any npm dependency compromise = total key exfil
shade_parish_ the fact that it took CVE assignment for people to care is the worst part. that file was world-readable for months before disclosure
3.5.6 through 3.5.10 affected means this was live for over a year before anyone noticed. how many crypto devs had keys sitting in tmp readable by any process
3.5.6 through 3.5.10 affected. if you havent updated since january you are literally donating your keys
3.5.6 through 3.5.10 is basically all of 2024. anyone who typed a seed phrase in iTerm2 last year should assume its compromised
framer.txt in tmp readable by any process. every dev who ever typed a private key in iTerm2 just had a moment
km_runner_ and the affected versions spanned months. 3.5.6 through 3.5.10 means this was silently exploitable since late 2024
The industry needs standardized security audit frameworks
writing terminal output to tmp framer txt where any local process can read it. at 98k btc thats basically leaving your seed phrase in a world-readable file. every crypto dev on macos was exposed
tmpfile_ghost_ macOS sticky bit on tmp is meaningless when every npm install runs as your UID. the unix model assumes you trust everything you execute
tmpfile_ghost nail on the head. /tmp on macOS defaults to world-readable via sticky bit but any process under your UID reads freely. one malicious npm install and your keys are gone
Multi-sig wallets should be the default for everyone in crypto
multi-sig doesnt help when youre typing seed phrases into a compromised terminal. the vulnerability here is the local attack surface, not wallet architecture
The cost of a security breach always exceeds the cost of prevention
CVE-2025-22275 is exactly that. a free terminal update fixes it but the cost of not updating could be your entire wallet. patch your tools people
seedplate_99 writing session output to /tmp/framer.txt readable by any local process is such a classic unix footgun. one curl command away from total key compromise
tmpfile_hunter_ writing plaintext terminal output to /tmp on a multi user system is a unix sin from the 90s. iterm2 should have used pipes or a socket
Hardware wallet adoption is the single biggest security improvement anyone can make
Social engineering attacks are becoming more sophisticated
Olga Smirnova social engineering for crypto keys is one thing but a terminal emulator itself leaking data is an entirely different threat level. you can train people not to click phishing links but you cant train them to stop using their terminal
seedplate_99 CVE-2025-22275 is exactly that. A free terminal update fixes it but the cost of not updating could be your entire wallet. Patch your tools people.
Multi-sig doesn’t help when you’re typing seed phrases into a compromised terminal. The vulnerability is the local attack surface, not wallet architecture.
Marcus O. exactly this. your ledger does nothing when the seed phrase is sitting in /tmp/framer.txt readable by any process running as your user
Lisa Anderson The industry really does need standardized security audit frameworks. Every platform seems to do their own thing.
CVE-2025-22275 being exploitable through session output means every iTerm2 user who typed a seed phrase in the last 6 months needs to assume compromise. patching after the fact is damage control not prevention. rotate everything