Leaderboard
699All-time rank
1inch Swap
Oct 31, 2024
$723K
Lost
$723K
Recovered
$0
Net loss
$723K
Unrecovered0% recovered
On October 30, 2024, attackers phished a LottieFiles npm account and published malicious lottie-player versions that injected an Ace Drainer wallet-connect prompt into every downstream site, including the 1inch web dApp. The 1inch frontend lacked npm package pinning or integrity checks, leaving it vulnerable to upstream compromise.
One user lost 10 wrapped BTC ($723K) from an Avalanche wallet; only the web frontend was affected.
- Target
- DeFi
- Classification
- Frontend & Infrastructure
- Technique
- Supply Chain Attack
- Attribution
- Unknown
- Chains
Avalanche
Event timeline
- Oct 31, 2024Exploit executed — $723K drained via supply chain attack
- Attributed to Unknown
- Recovery status Unrecovered 0%