What happened
On July 24, 2025, WOO X lost $14 million through unauthorized withdrawals from nine accounts. Its post-mortem traced access to a developer targeted with a malicious debugging project. WOO restored account details and compensated users from its treasury.
Technical root cause
A workstation compromise spread into the cloud environment and account-authentication database. Treasury compensation restored customer balances; it does not demonstrate recovery of the stolen assets.
How it happened
- A developer ran a project supplied through an apparent open-source collaboration. It installed a hidden backdoor.
- The attacker used the developer's existing VPN session to access Google Cloud and Kubernetes resources.
- A malicious pod exposed a management service-account token; another backdoor provided continuing production access.
- Extracted database credentials allowed changes to nine users' email, password and 2FA data, followed by withdrawals.
- WOO detected the activity about two hours later and suspended withdrawals. Trading continued.
Protocol details
Evidence
- report @BlockscopeCo incident report x.com
- report @_WOO_X incident report x.com
- report July 24th - Security incident post-mortem woox.io
- analysis Web Archive woox.io
- analysis Website reference cointelegraph.com
- analysis Website reference unchainedcrypto.com
- analysis DeFiLlama defillama.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
