IOTA wallet Hack

Reported loss $2.9M
Other

What happened

In February 2020, attackers compromised IOTA Trinity desktop-wallet users through illicit MoonPay SDK code served through MoonPay's CDN integration. After a wallet was unlocked, the code exfiltrated the user's seed and password to an attacker-controlled server; the IOTA Foundation halted the Coordinator on February 12 to interrupt theft and later coordinated a wallet update and seed migration.

How it happened

  1. The attacker gained the ability to alter MoonPay API delivery through the CDN path used by Trinity.
  2. Beginning January 25, illicit SDK code was served when affected users opened Trinity.
  3. Once a wallet was unlocked, the code decrypted and exfiltrated the user's seed and password.
  4. The attacker began using the compromised seeds for transfers on February 11.
  5. IOTA halted the Coordinator on February 12, released an updated wallet, removed MoonPay services, and required Trinity users to migrate to safe seeds before normal operations resumed.

Protocol details

Classification Other
Protocol Type Exploit/Other
Affected asset / contract MIOTA
Protocol links Website @iota

Evidence

Same attack technique

Browse all hacks →
Percent Finance $1.9M lost Yam DAO $750K lost Enigma $500K lost Doge Vault $51K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes