Ethereum Core Developer Loses Funds in Malicious AI Extension Attack

An experienced Ethereum core developer, known online as zak.eth, recently had part of his crypto holdings drained after installing a malicious AI-powered development extension.

The incident highlights how even highly security-conscious developers can be caught off guard by supply chain attacks that target trusted software sources.

How the exploit unfolded

According to a thread posted by zak.eth on X on August 12, the breach occurred on August 7 after he installed a Cursor AI extension named contractshark.solidity-lang from the Open VSX registry, the default source for Cursor extensions.

The tool appeared legitimate, had over 54,000 downloads, and was presented professionally. However, it secretly extracted private keys from a .env file on his system and sent them to a remote server.

Within minutes, the attacker gained access to his wallet, and by August 10, a few hundred dollars worth of Ethereum had been withdrawn.

While losses were relatively small due to his use of hardware wallets and segregated accounts, the breach showed how a single trusted installation can compromise even a well-protected environment.

The extension’s suspicious traits, lack of a GitHub repository and a publisher name resembling a legitimate one, aligned with recent warnings from security researchers.

In June, The Hacker News reported vulnerabilities in the Open VSX registry that could potentially give attackers influence over the Visual Studio Code extensions ecosystem.

Part of a larger campaign

Cybersecurity firm BleepingComputer has linked this exploit to a wider campaign that has stolen over $500,000, often by compromising developer tools and stealing GitHub tokens.

Zak.eth shared a forensic breakdown in his posts, urging developers to review Cursor logs, verify extension publishers, and avoid storing sensitive keys in .env files.

He also recommended enhanced setups including virtual machines, encrypted vaults, and hardware-only wallet policies. Other compromised extensions have been named, such as juanbIanco.solidity and solsafe, to help others avoid similar attacks.

Reflecting on the breach, zak.eth acknowledged that fatigue and urgency contributed to his decision to skip thorough checks. His takeaway for the community: verify before installing, maintain multiple layers of defense, and openly share incidents so others can learn.

Other Related Read/Listens

• Ethereum “Misuse” Lands Blockchain Dev in Turkish Detention, Here’s What We Know
• Hackers Strike Odin.fun, Draining $7M in Price Manipulation Attack
• BitMine Goes All In: $20B Stock Issuance to Buy More Ethereum