A well-known open-source tool designed to help traders on Solana has just been exposed as a trap.
Once the program is launched, it silently steals the user’s funds. The Solana GitHub Bot steals assets and sends them to a wallet address. That address has already moved funds through the crypto exchange FixedFloat. This discovery is a strong reminder that in crypto, even popular tools can hide serious threats.
The “solana-pumpfun-bot” gained popularity among retail traders and developers for helping automate trades on Solana’s pump.fun platform. The bot’s code was openly available on GitHub, giving users the impression it was trustworthy. But under the surface, the code included a backdoor that transferred tokens out of users’ wallets without their consent.
According to SlowMist, after users set up the bot and connected their wallet, the tool triggered a transfer of assets to a malicious address. The stolen funds were then funneled through FixedFloat, a crypto exchange that offers instant swaps and often does not require user verification. As of early July, the flagged address had received thousands of dollars in tokens.
This attack is part of a growing trend where bad actors use open-source platforms like GitHub to spread malware. These projects often look legitimate at first glance, making it hard for even careful users to spot the danger.
The Justice Department has announced a coordinated nationwide effort to crack down on North Korean remote IT workers engaged in illegal revenue schemes. Authorities seized 29 bank accounts, took down 21 fake websites, and confiscated over 200 devices linked to these operations.
More than $900,000 in stolen cryptocurrency was recovered, and over 100 U.S. companies were infiltrated by these operatives. Using stolen identities, fake shell companies, and networks of remote computers known as “laptop farms,” the North Korean agents generated and laundered millions of dollars.
The information discussed by Altcoin Buzz is not financial advice. This is for educational, entertainment, and informational purposes only. Any information or strategies are thoughts and opinions relevant to the accepted risk tolerance levels of the writer/reviewers, and their risk tolerance may differ from yours. We are not responsible for any losses you may incur due to any investments directly or indirectly related to the information provided. Bitcoin and other cryptocurrencies are high-risk investments, so please do your due diligence. Copyright Altcoin Buzz Pte Ltd.
Casper Network is betting big on EVM support, AI payments, and quantum-safe blockchain infrastructure with its new multi-year roadmap.
Microsoft's bet on Space and Time is starting to pay off with the launch of Dreamspace, a no code app builder
Worldcoin's World ID is now live and updated. It's out to prove you are human when on the web instead of dealing with a bot.
On July 2, a victim reached out to the SlowMist team after losing crypto assets. The cause? Running a seemingly legitimate GitHub project — zldp2002/solana-pumpfun-bot. 🕳️What looked safe turned out to be a cleverly disguised trap. Our analysis revealed: 1️⃣The perpetrator Show more
🚨SlowMist TI Alert🚨 The Justice Department Announces Coordinated, Nationwide Actions to Combat North Korean Remote Information Technology Workers’ Illicit Revenue Generation Schemes: 🔹 29 bank accounts seized 🔹 21 fake sites taken down 🔹 200+ devices confiscated 🔹 $900K+ Show more
