What happened
Trinity Wallet users began reporting unauthorized IOTA transfers on February 12, 2020. The IOTA Foundation traced the theft to malicious versions of the MoonPay SDK that Trinity loaded from MoonPay's CDN. After users unlocked the wallet, the injected code extracted their decrypted seed and password; the attacker then moved funds.
The Foundation reported 8.55 Ti stolen from 50 seeds, halted the coordinator to prevent further confirmed transfers, removed MoonPay integration, and prepared a seed-migration process.
How it happened
- An attacker used access to MoonPay's Cloudflare configuration to serve altered SDK code through the CDN that Trinity depended on.
- Trinity loaded the malicious code; when an affected user unlocked the wallet, it sent the decrypted seed and password to an attacker-controlled server.
- The attacker used the stolen seeds for unauthorized transfers. After user reports, the IOTA Foundation halted its coordinator, removed the integration, and organized seed migration.
Protocol details
Classification
Infrastructure / Frontend & Infrastructure
Protocol Type
Wallet
Protocol links
Website
@ricewallets
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
