On February 26, 2026 – The Vietnam-based DeFAI Holdstation smart wallet project (built on Worldcoin and BNB Chain) confirmed it was a victim of a serious supply chain attack in the early morning of February 25, 2026. The total loss recorded is 462,000 USDT.
This is the project’s second security incident in 2026, after losing approximately $100,000 in January.
Supply Chain Attack: Not Targeting Smart Contracts but Infrastructure
According to official statements, the hacker did not directly breach user wallets or smart contracts. Holdstation and the auditing firm Verichains confirmed that the smart contracts remain secure.
Instead, the attacker targeted the application distribution infrastructure – the platform that provides updates to users.
Specifically, the hacker:
After gaining control of the infrastructure, the attacker modified the JavaScript files in the official app version, inserting malicious code as a backdoor. Users updating the app inadvertently installed the infected version.
“Silent” Withdrawal Mechanism
The malicious code is designed to activate immediately after installation:
As a result, many wallets were drained within the first few minutes after the malicious update was released.
Holdstation’s Emergency Response Within 30 Minutes
According to the timeline released (UTC+7):
Subsequently, Holdstation coordinated with Verichains to analyze on-chain data and gather evidence for the investigation.
The current confirmed total loss is 462,000 USDT.
100% Refund Commitment to Users
Holdstation commits to fully reimburse affected assets. Users are required to fill out the official form at:
https://forms.gle/9FriUzFWHx6ZPXCS7
The team will verify on-chain ownership and authenticate wallets before issuing refunds. The project emphasizes that no seed phrase, private key, or any fees are required during the reimbursement process.
Security Lessons for the Industry
The incident shows that even if smart contracts are secure, vulnerabilities in the software distribution infrastructure can cause significant losses. This type of attack is a supply chain attack – where hackers infiltrate the “entry point” of the product rather than attacking users directly.
Holdstation stated it is upgrading its entire release process, including:
This incident has attracted significant attention from the Vietnamese crypto community, as Holdstation is one of the DeFi wallet projects based in Ho Chi Minh City.
The project promises to continue updating the investigation progress in the coming days.
Vương Tiễn
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Resolv Burns 46M USR After $80M Exploit, Wipes Out Illicit Supply in Major Recovery Push
Key Takeaways:
Resolv burned and put about 46 million USR (57%) of illegal supply to its blacklist
There is no hacker-related wallet which can transfer or swap USR
One of the measures is to upgrade contracts with coordination efforts to restrict impacts of the exploitation
After the recent
CryptoNinjas5h ago
Circle Lifts KYT Freeze on Wallets Tied to 500 Casino
The crypto space is once again debating control and transparency after blockchain investigator ZachXBT revealed a fresh update involving Circle. The company has now unfrozen two USDC wallets tied to 500 Casino and a user known as “Whale.” Together, the wallets held more than $330,000. This move
Coinfomania6h ago
Husband accused of his wife stealing 2,000-plus bitcoins! Judge: the plaintiff has a very high chance of winning
The UK High Court recently heard a case involving the theft of Bitcoin, where the plaintiff Ping Fai Yuen accused his estranged wife Fun Yung Li of secretly filming him to steal Bitcoin from his hardware wallet, worth approximately $176 million. Audio recordings and search warrant evidence support the plaintiff's claims, and the court upheld the asset freeze order, but dismissed part of the claims. The judge believes the plaintiff has a very high chance of winning and recommends that the case be heard as soon as possible.
区块客6h ago
AI programming issues! The convenience store near-expiry product app "Food Hunter" has a major security problem, exposing home GPS data.
The recently launched "Food Saver Hunter" app has raised concerns due to security issues, with user GPS data leaking and questionable API authorization. Additionally, Amazon has encountered system failures and financial losses, highlighting the risks of over-reliance on AI for programming. Experts are calling for stronger human oversight to ensure safety and accuracy.
CryptoCity7h ago
Ripple executives urgently refute rumors: There is no "secret XRP contract," social media misinformation stirs up waves again.
Rumors surrounding the "secret XRP contract" spread rapidly in 2026, with Ripple's Chief Technology Officer David Schwartz publicly denying it, emphasizing that no pre-allocation agreement had ever been confirmed. This incident originated from misleading posts on social media, drawing market attention and highlighting issues in the dissemination of cryptocurrency information, reminding investors to verify sources when confronted with sensitive news.
GateNews8h ago
Vietnamese police have uncovered a multi-billion dollar cryptocurrency scam, arresting seven people including blockchain trader Eric Vuong.
Vietnamese police have cracked a massive cryptocurrency fraud case, arresting businessman Eric Vuong and six accomplices, with the amount involved reaching several billion dollars. The gang sold counterfeit coins to users through the fake platform ONUS, and police have summoned over 140 people for investigation.
GateNews9h ago
