Swarm Malware Uses Ethereum to Find Hackers’ Control Servers
Compromised Swarm software targeted wallet keys and installed backdoors, with an Ethereum contract helping attackers redirect part of the malware’s control traffic.
Key Notes
- The affected releases are bee-js 13.3.0 and Swarm Desktop 0.56.2.
- Later-stage malware reads an Ethereum contract to locate its control server.
- Desktop 0.56.3 replaces the compromised build, but installed backdoors and exposed keys require separate remediation.
Attackers hijacked software releases used by the Swarm decentralized storage network to steal wallet credentials and install backdoors, including malware that consults an Ethereum smart contract to locate its control server.
The affected versions are the JavaScript package @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2. Researchers documented the supply-chain compromise on November 9. Maintainers have since withdrawn the malicious desktop release and published a replacement.
Official Releases Carried Hidden Loaders
Socket’s investigation says compromised GitHub accounts let attackers use Ethersphere’s own release automation. Both products contained a small loader that downloaded additional JavaScript and executed it on the victim’s machine. The origin of the stolen credentials remains unexplained, so the release history does not establish how the accounts were first compromised.
For bee-js, the added code ran during installation when package installation scripts were enabled. A developer did not need to import the library into an application first. Swarm Desktop packages carried the loader across Windows, macOS and Linux.
The distribution route matters because the software arrived through familiar project channels. Socket found valid publishing provenance for the npm package and an Apple-signed, notarized desktop build. Those signals identified the release process without establishing that its contents were safe.
Ethereum Acted as a Server Directory
OX Security’s analysis describes later-stage backdoors on Linux and macOS that read a control-server address from an Ethereum contract. The operator could change that address through the contract, redirecting infected machines without replacing their installed malware.
Ethereum supplied configuration data. The reports describe compromised software and external command servers, rather than a breach of Ethereum’s consensus or a smart-contract flaw that directly drained users’ wallets. Blocking one known server may therefore leave an infected machine able to locate another.
Swarm Wallet Credentials Were Targeted
SafeDep’s research found code targeting the encrypted Swarm-node wallet key and its locally stored password. Possessing both could give an attacker access to the node’s funds and stake. Additional payloads established remote access, creating risks for other secrets available to the compromised computer.
The published analyses do not establish a final count of infected users or total funds stolen. Download counters include researchers and automated scanners, so they cannot be treated as a victim count.
A Clean Update Is Only Part of Recovery
The official Desktop release replaces 0.56.2 with 0.56.3. Socket recommends bee-js 13.2.0 and checking whether affected software actually ran.
GitHub’s malware advisory urges users to treat affected computers as compromised and rotate exposed secrets from a different computer. Removing the package alone does not guarantee that additional malware has been removed.
The incident follows a separate documentation security warning from Trade.xyz. Both involve trusted software-distribution or publishing channels, but the available reports do not establish a connection between the attacks.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
