On February 26, 2026 – The Vietnam-based DeFAI Holdstation smart wallet project (built on Worldcoin and BNB Chain) confirmed it was a victim of a serious supply chain attack in the early morning of February 25, 2026. The total loss recorded is 462,000 USDT.
This is the project’s second security incident in 2026, after losing approximately $100,000 in January.
Supply Chain Attack: Not Targeting Smart Contracts but Infrastructure
According to official statements, the hacker did not directly breach user wallets or smart contracts. Holdstation and the auditing firm Verichains confirmed that the smart contracts remain secure.
Instead, the attacker targeted the application distribution infrastructure – the platform that provides updates to users.
Specifically, the hacker:
After gaining control of the infrastructure, the attacker modified the JavaScript files in the official app version, inserting malicious code as a backdoor. Users updating the app inadvertently installed the infected version.
“Silent” Withdrawal Mechanism
The malicious code is designed to activate immediately after installation:
As a result, many wallets were drained within the first few minutes after the malicious update was released.
Holdstation’s Emergency Response Within 30 Minutes
According to the timeline released (UTC+7):
Subsequently, Holdstation coordinated with Verichains to analyze on-chain data and gather evidence for the investigation.
The current confirmed total loss is 462,000 USDT.
100% Refund Commitment to Users
Holdstation commits to fully reimburse affected assets. Users are required to fill out the official form at:
https://forms.gle/9FriUzFWHx6ZPXCS7
The team will verify on-chain ownership and authenticate wallets before issuing refunds. The project emphasizes that no seed phrase, private key, or any fees are required during the reimbursement process.
Security Lessons for the Industry
The incident shows that even if smart contracts are secure, vulnerabilities in the software distribution infrastructure can cause significant losses. This type of attack is a supply chain attack – where hackers infiltrate the “entry point” of the product rather than attacking users directly.
Holdstation stated it is upgrading its entire release process, including:
This incident has attracted significant attention from the Vietnamese crypto community, as Holdstation is one of the DeFi wallet projects based in Ho Chi Minh City.
The project promises to continue updating the investigation progress in the coming days.
Vương Tiễn
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
AI agents bypass Cloudflare protection, encrypting DeFi front-end security faces further tests
Recently, the autonomous AI agent OpenClaw successfully bypassed Cloudflare defenses using the Scrapling library, raising concerns about DeFi security. Although the tool can legally scrape content, the potential risks remind developers to establish multiple layers of defense and avoid over-reliance on traditional protection measures.
GateNews5m ago
MONTRA token team "ran away," causing the market cap to instantly evaporate by 80%, blamed on Iran's conscription.
Cryptocurrency project Montra Finance has suspended its project after the development team was conscripted by Iran, leading to an 80% plunge in the token's market value. The lack of official information has raised investor doubts, with some believing this is a "exit scam." The incident highlights the impact of geopolitics on the crypto market, and investors should remain cautious of opaque projects.
GateNews12m ago
Netizens want to bet on the "Iranian Rial": it has fallen 90% and will definitely rebound! Is this kind of war gamble worth buying?
The Iranian rial has plummeted over 96% in two months, hitting a record low. If a nuclear agreement is reached with the United States, the rial may have room for a rebound, but purchasing options are difficult and risky. Investors should be aware of U.S. sanctions risks and potential impacts of Iran's currency reforms on exchange rates. Many people are exchanging rial through cryptocurrencies, but caution is advised.
動區BlockTempo34m ago
South Korean "declared dead" crypto scammer has had their identity restored, converting crypto assets to compensate victims with $60,000
A cryptocurrency scam suspect declared dead has regained legal status after being deported back to South Korea, and is compensating victims by selling frozen assets. The incident has sparked discussions on cross-border law enforcement and crypto scam recovery mechanisms. It also highlights the legal complexities and regulatory challenges South Korea faces in digital asset cases.
GateNews41m ago
Solv Protocol suffers $2.7 million vulnerability attack: SolvBTC vault was stolen, but the SOLV token price remains unaffected
Solv Protocol's BRO vault was attacked, resulting in the theft of approximately 38 SolvBTC, with a loss of about $2.7 million. Fewer than 10 users were affected, and the platform has promised full compensation and taken technical measures to patch the vulnerability. The incident did not impact the SOLV token price, indicating investor confidence. DeFi protocol security issues still require attention, emphasizing the importance of audits and real-time monitoring.
GateNews1h ago
iPhone users beware! Google warns: Coruna attack toolkit is rampant, exclusively stealing cryptocurrencies
Google releases a report revealing that the iOS package named Coruna contains 23 vulnerabilities. This tool has evolved from a national surveillance tool into an asset hijacking mechanism targeting iPhone users. Attackers use "watering hole attacks" to lure victims, exploiting zero-click vulnerabilities to infiltrate devices without interaction, extracting digital assets and sensitive information. Experts recommend users update their systems promptly and use hardware wallets to defend against this threat.
CryptoCity1h ago
