Jared’s $7.5M Approval Sweep, 144 Poisoned npm Packages, and Aztec Drained Twice in a Week | Burn Notice #6
A counter-MEV bot tricked into authorising its own drain, a North Korean crew republishing a million-download package scope, and a four-year-dead bridge that still held live money. None of it required
Five teams lost money this week, and not one of them was beaten by clever cryptography. In every case the code ran as written, and the loss came from the housekeeping around it, the parts of a system that someone configures once and never revisits.
In today’s issue.
How a counter-MEV honeypot turned Jared’s own token approvals into a $7.5M withdrawal.
Why 144 poisoned Mastra packages mean your build pipeline, not your contract, is the soft target.
Aztec drained twice in one week, and why deprecated contracts are now a target.
Need to Know
Most of this week’s losses were self-inflicted. A front-running bot was tricked into signing away its own treasury, a four-year-dead bridge paid out against a forged proof, a privacy chain minted wrapped assets without checking where they came from, and a software supply chain delivered a backdoor through a contributor account that nobody had bothered to close. None of these attacks needed a new cryptographic break, only a permission, a key, or a validation step that someone had left running unattended. —Adrian
The Big One. Jared’s Own Approvals Drained It of $7.5M
The news. Jaredfromsubway.eth, the address tied to roughly seventy per cent of Ethereum’s sandwich attacks since 2023, was emptied of more than $7.5M over the weekend of 20 June. Blockaid, which spotted the sweep, said plainly that this was neither a stolen key nor a flaw in Jared’s own contract Blockaid via The Defiant. The attacker spent weeks building a trap out of the bot’s own behaviour, and the bot walked into it the way it walks into everything, at machine speed.
What broke and how. A token approval on Ethereum is easy to mistake for a one-off click. It is really a standing grant that lets another contract move your tokens whenever it likes, until you take it back. Jared’s bot handed out those grants as a routine part of its sandwich workflow, approving helper contracts so they could spend its WETH, USDC and USDT during a trade. The attacker deployed sixty-six counterfeit token contracts dressed up as WETH, USDC and USDT, then fed the bot small, real profits across about ninety-seven blocks so it would keep engaging Thirdweb post-mortem. The routes were crafted so the approvals the bot generated were never consumed during the trade and never revoked afterwards. Once enough of those grants stood open, the attacker sent a single transaction that called transferFrom across all of them and pulled out around 1,474 WETH, 2.87M USDC and 2M USDT, much of which has already gone through Tornado Cash The Block.
Why it kept happening. The dangling approval is one of the oldest unsolved problems on Ethereum, and it drains ordinary wallets every week through malicious tokens that ask for permission and are granted it without thought. Jared industrialised the same mistake. Its contracts approved spenders at speed and on the assumption that the pools it touched were either honest or too small to matter, which held until somebody spent a fortnight proving otherwise. A single approve(0) after each trade would have closed the door, and the whole loss comes down to the bot never making that call The Block.
What to check now.
Enumerate every live approval your contracts and operational wallets have granted, and treat the list as a liability register rather than a log.
Bound approvals to the exact amount a transaction needs. An unbounded
max uint256approval is a permanent withdrawal slip left on the table.Revoke after use. An integration that cannot call
approve(0)at the end of a flow has a design defect to fix.Refuse to interact with unvetted token contracts at automated speed. Speed is the attacker’s ally in every honeypot of this shape.
Alert on any
transferFromagainst your contracts that your own logic did not initiate.
Jared did nothing its own code forbade. It approved spenders the way it had thousands of times before, and someone spent a month turning that routine into a single drain. Any stack that grants approvals faster than a human ever reviews them is running the same bet Jared just lost for $7.5M.
— Adrian
Chain Reaction. 144 Poisoned Packages and a Maintainer Account No One Closed
The news. On 17 June an attacker took control of a dormant Mastra contributor account and, inside eighty-eight minutes, republished 144 packages across the @mastra npm scope, each carrying one injected dependency StepSecurity. Mastra is an open-source TypeScript framework for building AI agents, and its core package alone pulls more than 900,000 downloads a week. On 19 June Microsoft attributed the campaign, with high confidence, to Sapphire Sleet, the North Korean crew also tracked as BlueNoroff Microsoft Threat Intelligence.
What broke and how. The malware was not in Mastra’s code, which the attacker never touched. It hid one level down, in a dependency called easy-day-js, a near-perfect forgery of the popular dayjs date library that copied the real package’s author, homepage and licence so a developer skimming the dependency list would see nothing wrong Orca Security. A clean version went up first as bait, then a weaponised one with a postinstall hook that ran the moment anyone installed the package. The hook dropped a cross-platform remote-access trojan that disabled certificate checks, phoned a control server, and went hunting for cloud credentials, LLM API keys and the contents of 166 cryptocurrency wallet extensions. Because the affected packages used a caret version range, ordinary installs upgraded themselves to the poisoned release without anyone choosing to. The entry point was a former contributor account, ehindero, whose publish rights across the whole scope had never been revoked, and whose owner had reportedly been social-engineered through a LinkedIn approach and a link clicked during a call The Hacker News.
Why it kept happening. This is the second time in 2026 that Microsoft has pinned an npm compromise on the same North Korean group, after a near-identical attack on the Axios HTTP client in the spring. npm does not expire a maintainer’s scope access for inactivity, so a stale credential stayed dangerous for over a year. No CVE was ever assigned, which meant every scanner that waits for a CVE was blind throughout the attack TechTimes. Mastra generated build provenance on its real releases but did not require it, so a personal token could publish without an attestation and nobody’s install rejected it. The attacker never broke into the code, walking in instead through the parts of the process that nobody had ever treated as security.
What to check now.
Search every project and CI runner for the affected
@mastraversions and foreasy-day-jsin lockfiles. Mastra 1.13.0 and earlier are clean.Require signature or provenance verification on install, with
npm audit signaturesor a policy that rejects packages lacking attestations. That single control would have blocked this entire wave.Revoke scope publish rights for every maintainer who has gone quiet, because an account nobody uses can still publish.
Treat any machine that ran the install as fully compromised, rotate every credential reachable from it, and move hot-wallet funds to keys generated on a clean device.
By 2026 the audited code is the hard part of the stack, so attackers have moved to the laptop and the off-chain modules instead. A crew that wants your keys no longer needs to break your code when it can publish a backdoor under a name you already trust and wait for you to type
npm install.— Adrian
The Operator’s Read
The Soft Target Moved Off-Chain
An attacker took over a quiet contributor account this month and, in under two hours, republished 144 packages across a widely used npm scope, each one carrying a backdoor. There was no flaw in the code and no clever cryptography involved. The way in was an account with publish rights that nobody had closed.
That is where Web3 security has arrived. The audited code is now the hardest part of the stack to break, so attackers have stopped aiming at it. They go after the build pipeline and the people who run it, and almost no one has moved their security budget to match.
Look at what actually took money this week. The contract drains landed on dead code. Aztec lost funds from infrastructure it had retired years ago, and Secret Network lost more from a token contract that had been forked, quietly stripped of a validation check, and never re-audited. The live, reviewed code mostly held, and the losses came in through the edges where review had stopped looking.
Mastra is the clean example of the shift. It is an open-source framework for building AI agents, with a core package pulled close to a million times a week. The attacker never touched its code. Instead they took over a former contributor account that still held publish rights across the whole scope, and hid the payload one level down, in a dependency dressed up as a popular date library. The hook ran on install, and through it the attacker collected cloud credentials, model API keys and the contents of crypto wallet extensions. Microsoft traced the campaign to the North Korean group also tracked as BlueNoroff, again this year, after a near-identical attack on the Axios library in the spring.
The same crew works the human layer at the same time. Through the spring they ran fake video calls seeded with deepfaked colleagues and moved Web3 founders from a friendly catch-up to a compromised laptop in minutes. The Mastra maintainer was reportedly pulled in the same way, through a message and a link during a call. What these crews want is the person with the keys, and the machine those keys live on.
None of this is exotic. An attacker has finite hours and spends them where the return is highest, and for years that meant the contract. The contract is hard now, so the maths moved. Poisoning a dependency or staging a fake meeting pays better than another month spent reading reviewed code. And the slow part of that work, the recon, the staging, the patient impersonation, is the part machines now do cheaply. One researcher reportedly earned around half a million dollars from Google’s bug bounty in under ninety days by wiring an AI model into an automated testing loop. He reported that figure himself, and Google has not confirmed it. The same automation that helps a defender find bugs faster lets an attacker run more of these campaigns at once.
Most security budgets have not absorbed any of this. The audit line is mature and well understood. The supply-chain line barely exists, which leaves the npm token that can publish to a scope your users trust protected by whatever someone set up once and forgot. So treat the build pipeline as production, because it already is. Require provenance or signature verification on every install. Revoke publish rights for maintainers who have gone quiet. Confirm any meeting link or recovery request through a second channel before anyone clicks.
The point is simple enough to act on this week. An attacker is least likely to reach you through the part of the stack you have spent the most defending, and most likely to reach you through the build pipeline and the people who feed it. You can probably name the firm that last audited your contracts and the month they did it. Do the same for the accounts that can publish into your build and the people who hold them, and see how fast you run out of answers.
— Adrian
Sources. Cloudsmith and Microsoft Threat Intelligence on the Mastra compromise, Arctic Wolf on the fake-meeting campaign, and TechRepublic on the Google bounty figure.
Around the Forums
Axelar’s emergency committee pulled the cord on Secret Network. After the Secret bridge drain surfaced, Axelar’s emergency committee disabled the Secret and Secret-SNIP connections to stop the loss spreading, and said its firewalling kept the damage off other chains Axelar via crypto.news. The precedent worth noting is governance by kill-switch. A standing committee that can sever a route within hours is now a load-bearing part of cross-chain safety, and protocols without one are relying on goodwill and working hours.
Aztec Foundation drew a line around the dead contracts. After both drains, the Aztec Foundation stated repeatedly that the affected products were deprecated years ago and have no link to the current network or the AZTEC token Aztec Foundation via NullTX. The claim is technically accurate and does nothing for the people who watched $4M leave the ecosystem in three days. It also sets an awkward precedent for how teams talk about immutable code they can no longer control. The disclaimer is accurate, but what users take away is that the money still left the ecosystem and the team’s name was on the contract.
What Else Happened
Bridge proof-forgery. Taiko halted its Ethereum layer-2 and told users to abandon every bridge after an attacker forged withdrawal proofs and drained about $1.7M on 22 June, with BlockSec tracing the likely cause to a Raiko SGX signing key left in a public GitHub repository CoinDesk.
Source-channel validation gap. Secret Network’s Axelar bridge lost about $4.67M to an infinite-mint flaw in a forked CW20-ICS20 contract that had quietly dropped its origin checks during an unaudited migration, letting an attacker spin up a single-validator chain and forge deposits that minted unbacked wrapped tokens Common Prefix via The Block.
Missing access control on dead code. Aztec’s deprecated infrastructure was drained twice, on 14 and 17 June, for roughly $4.3M combined, after attackers fed forged proofs to an
escapeHatchfunction that carried no owner check and a verifier that accepted proofs with the rollup size set to zero SlowMist via The Crypto Times.Actively exploited RCE in your monitoring stack. Attackers are exploiting CVE-2026-20253, an unauthenticated remote code execution flaw in Splunk Enterprise, and CISA added it to its Known Exploited Vulnerabilities catalogue with a federal patch deadline of 21 June SecurityWeek.
Memecoin reserve drains on BNB Chain. A logic flaw in the OLPC/LABUBU pool was milked for about $1.1M, part of a steady run of small fee-on-transfer and reserve-skew drains that rarely make headlines but never stop SlowMist.
Wallet-stealing mobile malware. Researchers detailed Rokarolla, an Android banking trojan that targets 217 banking and crypto apps and can lift PINs, intercepted SMS codes and wallet funds, a reminder that the phone in a treasury signer’s pocket is part of the attack surface.
Patch Notes
Splunk. If you run Splunk Enterprise and have not patched, you are already past the federal deadline and the flaw is being exploited in the wild. Patch today and hunt for signs you were reached first.
Mastra and npm. Anything that ran an
@mastrainstall after 16 June should be treated as compromised. Rotate every credential reachable from those machines now, and move any funds controlled from them to keys created on a clean device.Taiko. If you hold anything in a Taiko bridge, withdraw it and do not bridge to or from the network until the team issues an official all-clear.
Long Reads
Thirdweb on the Jared approvals honeypot. The clearest builder-facing breakdown of dangling approvals, with the exact pattern any team integrating
approveshould read before shipping.SlowMist on the Aztec escapeHatch drains, alongside BlockSec’s note that both incidents shared a public-input binding failure. Worth it if you maintain any verifier that accepts caller-supplied proof inputs.
Microsoft Threat Intelligence on the Mastra compromise, alongside JFrog’s loader and C2 reconstruction. Read the Microsoft piece for attribution and the JFrog work for indicators you can hunt on tonight.
Common Prefix on the Secret Network infinite mint. A precise account of how removing two source-validation checks in a forked IBC contract turned a year-old bug into a $4.67M drain. Mandatory if you maintain custom token-handling on IBC.
Perimeter on the $69M Polkadot near-miss. The week’s counter-example. A researcher caught an XCM origin-isolation flaw through targeted fuzzing before anyone lost a cent, for a $75,000 bounty. A good argument for funding fuzzing on any protocol with caller-supplied inputs, since these semantic bugs rarely surface as crashes.
Closing Tab
Taiko promised a full post-mortem on the signing key it left in a public repo, and the thing to watch before the next issue is whether it points to a fix the year's other bridge drains could have used or just records one more secret that should never have been committed.
Adrian Hetman Burn Notice Operational intelligence for Web3, every week