On February 26, 2026 – The Vietnam-based DeFAI Holdstation smart wallet project (built on Worldcoin and BNB Chain) confirmed it was a victim of a serious supply chain attack in the early morning of February 25, 2026. The total loss recorded is 462,000 USDT.
This is the project’s second security incident in 2026, after losing approximately $100,000 in January.
Supply Chain Attack: Not Targeting Smart Contracts but Infrastructure
According to official statements, the hacker did not directly breach user wallets or smart contracts. Holdstation and the auditing firm Verichains confirmed that the smart contracts remain secure.
Instead, the attacker targeted the application distribution infrastructure – the platform that provides updates to users.
Specifically, the hacker:
After gaining control of the infrastructure, the attacker modified the JavaScript files in the official app version, inserting malicious code as a backdoor. Users updating the app inadvertently installed the infected version.
“Silent” Withdrawal Mechanism
The malicious code is designed to activate immediately after installation:
As a result, many wallets were drained within the first few minutes after the malicious update was released.
Holdstation’s Emergency Response Within 30 Minutes
According to the timeline released (UTC+7):
Subsequently, Holdstation coordinated with Verichains to analyze on-chain data and gather evidence for the investigation.
The current confirmed total loss is 462,000 USDT.
100% Refund Commitment to Users
Holdstation commits to fully reimburse affected assets. Users are required to fill out the official form at:
https://forms.gle/9FriUzFWHx6ZPXCS7
The team will verify on-chain ownership and authenticate wallets before issuing refunds. The project emphasizes that no seed phrase, private key, or any fees are required during the reimbursement process.
Security Lessons for the Industry
The incident shows that even if smart contracts are secure, vulnerabilities in the software distribution infrastructure can cause significant losses. This type of attack is a supply chain attack – where hackers infiltrate the “entry point” of the product rather than attacking users directly.
Holdstation stated it is upgrading its entire release process, including:
This incident has attracted significant attention from the Vietnamese crypto community, as Holdstation is one of the DeFi wallet projects based in Ho Chi Minh City.
The project promises to continue updating the investigation progress in the coming days.
Vương Tiễn
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Solv Protocol was hacked and approximately 38 SolvBTC, worth about $2.7 million, were stolen.
Solv Protocol announced a vulnerability in its single BRO Vault, affecting fewer than 10 users with a loss of approximately $2.7 million in SolvBTC. Other funds are secure, and preventive measures have been taken. The official team has contacted the hacker and will offer a 10% white-hat bounty in exchange for the return of the funds.
GateNews1h ago
TRM Labs Reports $35B Lost to Crypto Scams Worldwide in 2025
TRM Labs reports a rise in global crypto fraud, reaching $35 billion in 2025, likely underestimating actual losses. Enhanced training and blockchain tools are essential for law enforcement to combat sophisticated fraud schemes effectively.
TheNewsCrypto11h ago
Iran and North Korea are both using it! Stablecoins have become the preferred virtual asset for illegal transactions, with involved fraud totaling $51 billion.
According to the FATF report, stablecoins have become the preferred asset for illegal transactions, especially in countries like Iran and North Korea. The organization calls for increased regulation of stablecoin issuers and states that by 2025, stablecoins will account for the majority of illegal virtual asset transactions. To address these challenges, the FATF recommends that issuers strengthen their technical capabilities to improve regulatory efficiency.
区块客11h ago
Address Poisoning Scam: TON Whale Loses $220K, Scammer Returns Most
_A TON blockchain whale sent $220K to a scammer by mistake. The scammer kept $17K and returned the rest with an apology note._
A TON blockchain whale recently fell victim to an address poisoning scam.
The incident cost him $220,000 worth of TON tokens. He sent the funds to the wrong wallet by
LiveBTCNews12h ago
OpenClaw has a "self-attack" vulnerability: mistakenly executing Bash commands leading to key leakage
GoPlus reports that the AI tool OpenClaw experienced a self-attack security incident due to incorrect Bash commands causing sensitive environment variables to be leaked. It is recommended to use API calls in AI development, follow the principle of least privilege, restrict high-risk operations, and introduce manual review.
GateNews12h ago
Prince Group is laundering 10.7 billion NT dollars in Taiwan! Developing their own "OJBK Wallet" to connect with underground currency exchanges.
The Taipei District Prosecutors Office is investigating the Cambodia "Prince Group" money laundering case, involving illegal proceeds of up to 10.7 billion. Sixty-two people, including Chen Zhi, have been indicted. The group was found to be using USDT and their self-developed "OJBK Wallet" for cross-border money laundering. Chen Zhi directed the establishment of companies in multiple countries, disguising criminal proceeds through false transaction contracts, and purchasing luxury homes and high-end cars. The prosecution is seeking a maximum sentence of 13 years for him.
区块客14h ago
