Open source packages published on the npm and PyPI repositories were laced with code that stole wallet credentials from dYdX developers and backend systems and, in some cases, backdoored devices, researchers said.

“Every application using the compromised npm versions is at risk ….” the researchers, from security firm Socket, said Friday. “Direct impact includes complete wallet compromise and irreversible cryptocurrency theft. The attack scope includes all applications depending on the compromised versions and both developers testing with real credentials and production end-users.”

Packages that were infected were:

npm (@dydxprotocol/v4-client-js):

• 3.4.1
• 1.22.1
• 1.15.2
• 1.0.31

PyPI (dydx-v4-client):

Perpetual trading, perpetual targeting

dYdX is a decentralized derivatives exchange that supports hundreds of markets for “perpetual trading,” or the use of cryptocurrency to bet that the value of a derivative future will rise or fall. Socket said dYdX has processed over $1.5 trillion in trading volume over its lifetime, with an average trading volume of $200 million to $540 million and roughly $175 million in open interest. The exchange provides code libraries that allow third-party apps for trading bots, automated strategies, or backend services, all of which handle mnemonics or private keys for signing.

The npm malware embedded a malicious function in the legitimate package. When a seed phrase that underpins wallet security was processed, the function exfiltrated it, along with a fingerprint of the device running the app. The fingerprint allowed the threat actor to correlate stolen credentials to track victims across multiple compromises. The domain receiving the seed was dydx[.]priceoracle[.]site, which mimics the legitimate dYdX service at dydx[.]xyz through typosquatting.

Bitcoin’s price sank to $63,000 on Thursday, its lowest level in more than a year, and half its all-time peak of $126,000, reached in October 2025. A months-long dip in cryptocurrency prices has tanked shares of companies that have increasingly invested in bitcoin, exacerbating broader stock market jitters.

Bitcoin rode a high during Donald Trump’s ascent to the presidency in 2024 and throughout 2025; its price steadily increased as the president made one industry-friendly move after another. Crypto’s largest currency hit $100,000 for the first time in December 2024 and even rose to a record high of $126,210.50 on 6 October, according to Coinbase. But bitcoin’s valuation has dipped over the last few months, falling especially hard in January and the start of February.

Companies that went all in on bitcoin have been hit hard in the recent sell-off. CoinGecko data shows that the global crypto market has lost $2tn in value since early October. Multiple cryptocurrency ventures backed by the Trump family and listed on the stock market saw their values decline in response to bitcoin’s slump.

Bitcoin, which emerged after the 2008 financial crisis as a way to bypass banks and traditional payment methods, is the world’s most valuable cryptocurrency. The second-largest cryptocurrency, ether, has faced losses of more than 30% this year alone, adding insult to injury after it missed out on the boom of 2025.

In addition to financial disaster, the cryptocurrency faces regulatory headwinds. Some Democrats and watchdogs in the US have raised alarms about Trump’s conflicts of interest around cryptocurrencies and a lack of regulation under the current administration. US representative Ro Khanna said on Wednesday that he planned to investigate World Liberty Financial, following reports from the Wall Street Journal that a member of the Emirati royal family backed a $500m investment into the Trump family’s cryptocurrency company. Khanna wrote in a statement that the reported deal “may have contributed to changes to US policy”.