Injective Labs GitHub Hack: What Happened

Attackers breached the Injective Labs SDK project’s GitHub repository and used it to push a malicious package to the npm registry. The package, @injectivelabs/sdk-ts@1.20.21, was designed to steal cryptocurrency wallet private keys and mnemonic seed phrases.

The compromised version contained fake telemetry functionality. Instead of collecting legitimate usage data, it exfiltrated sensitive wallet information. Anyone who installed this package risked losing access to their crypto funds.

This is a classic supply chain attack. The attackers didn’t break into individual developer machines — they targeted the source code repository itself, injecting malicious code that downstream users would trust and install.

How the Malicious Package Stole Wallet Keys

The fake telemetry in @injectivelabs/sdk-ts@1.20.21 didn’t just phone home with harmless metrics. It specifically targeted cryptocurrency wallet private keys and mnemonic seed phrases — the two pieces of data that give full control over a blockchain wallet.

Once a developer or project integrated this compromised package, the malicious code would activate during runtime. It collected wallet credentials and sent them to servers controlled by the attackers. The code was disguised as routine telemetry, making it harder to spot during code reviews.

Private keys are the ultimate prize in crypto theft. With a private key, an attacker can sign transactions and move funds without any additional authentication. Seed phrases (also called recovery phrases) are equally dangerous — they can regenerate an entire wallet on any device.

Timeline and Response

Security researchers identified the malicious package shortly after it appeared on npm. The compromised version was published on an unknown date, but the Injective Labs team moved quickly once alerted.

The malicious version has been removed from the npm registry. Injective Labs also published a security advisory warning users not to use @injectivelabs/sdk-ts@1.20.21 and to immediately rotate any wallet keys that may have been exposed.

If you or your project used this specific version, the safest course is to:

• Check your package-lock.json or yarn.lock for @injectivelabs/sdk-ts@1.20.21
• Treat any wallet that was active on a machine with this package as compromised
• Generate new wallet addresses and transfer funds immediately
• Run a full security audit of your development environment

Lessons for the Crypto Development Community

This incident is a stark reminder that trust in open-source packages has limits. The npm ecosystem, like PyPI and RubyGems, has seen repeated supply chain attacks. Crypto projects are especially attractive targets because a successful breach yields direct financial gain.

What makes this attack particularly insidious is that it targeted the crypto wallet key theft vector through a trusted SDK. Developers using Injective Labs’ tools likely had no reason to suspect the package was compromised. The attackers exploited that trust.

For teams building on blockchain infrastructure, several practices can reduce risk:

Verify Package Integrity

Always check package hashes against official sources. npm supports integrity checking via package-lock.json. If a package’s hash changes unexpectedly, that’s a red flag.

Pin Dependencies

Don’t use loose version ranges like ^1.20.0. Pin to exact versions and review updates manually. This won’t prevent all attacks, but it buys time to vet new releases.

Monitor for Anomalies

Sudden changes in package behavior — like new network requests or unexpected file system access — should trigger immediate investigation. Tools like Socket can automate this monitoring.

What Injective Labs Users Should Do Now

If you’re an Injective Labs SDK user, the immediate priority is determining whether you ever installed version 1.20.21. Even if you’ve since updated, the damage may already be done.

Check your npm audit logs and CI/CD pipeline history. If the malicious package ran in any environment that had access to wallet keys, those keys are compromised. The attackers may have already copied them.

For developers who suspect exposure, the safest move is to treat all wallets used in that environment as burned. Generate fresh wallets and transfer funds. This is inconvenient, but it’s far cheaper than losing everything to a delayed attack.

The Injective Labs team has been transparent about the breach, which is commendable. But the incident underscores a broader truth: in crypto, a single compromised dependency can empty your wallet in seconds. Vigilance isn’t optional — it’s the price of participation.

Inside the Negotiation: How a County Agreed to Pay $1 Million in Bitcoin

A local government entity in the United States — widely believed to be a small county in Ohio — reportedly paid a $1 million ransom to the cyber extortion group known as Kairos. The payment was made to prevent the public release of sensitive data stolen during a breach in May 2025, according to a report from Ransom-ISAC.

The incident did not involve file-encrypting ransomware. Instead, it was a pure extortion play: the attackers stole data and demanded payment to keep it quiet. A leaked negotiation transcript, obtained by Ransom-ISAC, reveals the back-and-forth between the victim and the criminals.

Kairos initially demanded $3 million in cryptocurrency. The victim countered with $100,000. Over three weeks, the offer crept up to $430,000. But the group held firm. Eventually, the county accepted a hard deadline and wired $1 million in Bitcoin on June 13.

“The affected entity’s responses are consistent with an organization buying time while legal, leadership, financial, and communications decisions were coordinated,” Ransom-ISAC noted.

Who Is the Victim? Union County, Ohio, Appears to Be the Target

Ransom-ISAC did not name the organization outright. But the negotiation transcript describes it as “a small county with very limited resources.” Public records point to Union County, Ohio. In September, the county filed a data breach notification with the state, warning 45,487 individuals that their personal information had been stolen in a May 2025 ransomware attack.

The stolen data is staggering in its scope. It includes names, dates of birth, driver’s license numbers, state ID numbers, passport numbers, Social Security numbers, financial account details, fingerprint data, medical information, and payment card details.

SecurityWeek has reached out to Union County for comment. At the time of writing, the county has not responded.

How the Attack Happened: Brute Force and 2 Terabytes of Data

Kairos claimed to have stolen over 2 terabytes of data — roughly 1.6 million files — after breaking into the county’s environment through a brute-force attack. That’s a simple but effective method: attackers try thousands of username and password combinations until they find one that works.

Once inside, the group scraped file servers systematically. The attackers did not deploy ransomware. They didn’t need to. The threat of exposure was enough to pressure the cash-strapped county into paying.

Ransom-ISAC noted that the attackers’ “proof of deletion” — a video supposedly showing them wiping the stolen data after payment — was not independently verifiable. The organization said the deletion could have been faked by erasing only a copy of the data. “No mechanism to independently verify the deletion was provided,” the report states.

Why This Case Matters for Local Governments

This incident is a stark reminder that ransomware attacks are evolving. Many local governments have limited cybersecurity budgets and small IT teams. They are prime targets for cybercriminals who know that a breached election database or a leaked police report can cause chaos.

The ransom payment of $1 million is a huge sum for a small county. It raises difficult questions: Should governments ever pay? The FBI and CISA strongly advise against it, arguing that payments fund further crime. But when the alternative is having citizens’ Social Security numbers and medical histories dumped online, the calculus changes.

Ransom-ISAC’s analysis suggests the county’s slow negotiation was a deliberate strategy. The organization bought time to consult with legal counsel, leadership, and financial advisors. In the end, they paid — but they didn’t pay the full $3 million.

What Happens After the Payment?

The data breach notification filed by Union County suggests that the stolen information is now considered compromised. Even if Kairos deleted the files, the data could have been copied multiple times. Victims should monitor their credit reports, financial accounts, and medical records for signs of identity theft.

For other local governments, the takeaway is clear: invest in multifactor authentication, regular security training, and robust backup systems. A brute-force attack should not be able to bring down an entire county’s data infrastructure.

As for Kairos, the group remains active. The $1 million payout will likely fund more attacks. The cycle continues.

The Blast Radius of Modern Conflict

War doesn’t stay in one place anymore. When Russia invaded Ukraine in 2022, the shockwaves rippled through fiber-optic cables and server racks, not just trenches and bridges. A Ukrainian tax software company, Intellias, found itself at the epicenter of a new kind of battle — one fought with malware, DDoS attacks, and data wipes. Its story is a brutal lesson for any business that thinks geography offers protection.

Intellias, which develops tax and accounting platforms for clients in Europe and North America, didn’t just lose power or internet access. Its infrastructure became a target. Hackers linked to state actors tried to cripple its systems, hoping to disrupt tax collection and sow chaos. The company survived, but barely. Its experience reveals a hard truth: in the age of cyberwarfare, every business with a digital footprint is a potential combatant.

The Attack That Almost Killed a Company

In March 2022, Intellias faced a coordinated assault. Attackers deployed a wiper malware variant called CaddyWiper, designed to erase data from Windows machines. They also hammered the company’s cloud services with distributed denial-of-service (DDoS) attacks, aiming to knock its platforms offline during peak tax season.

The firm’s IT team scrambled. They had to assume their on-premise servers were compromised. So they pivoted entirely to backups stored in a different cloud region — one in Poland, far from the conflict zone. It wasn’t a smooth transition. Engineers worked 20-hour shifts, sleeping on office floors. Some fled the country with families in tow, coding from hotel rooms in Warsaw or Berlin. The attack cost millions in lost revenue and emergency IT spending.

But here’s the key: they had a plan. Not a generic disaster-recovery document, but a specific wartime playbook that accounted for physical displacement, supply-chain disruption, and targeted cyberattacks. That plan is what saved them.

Why Your Business Needs a Wartime Gameplan

You might think: I’m not in Ukraine. I’m not a tax software firm. Why should I care? Because the attackers don’t discriminate by geography. They target by opportunity. If your company handles sensitive data, processes payments, or runs critical infrastructure, you’re on the map.

Consider this: in 2023, cyberattacks on critical infrastructure rose by 40% globally, according to the Cybersecurity and Infrastructure Security Agency. Many of those attacks were tied to geopolitical conflicts — Russia-linked groups hitting energy grids in Europe, Chinese-linked actors probing US telecoms. The battlefield is now everywhere.

A wartime gameplan isn’t just for defense contractors. It’s for any business that wants to survive a prolonged, state-backed assault. Here is what that plan should include:

• Geographic redundancy: Don’t keep all backups in one region. Use multiple cloud providers or data centers in different countries. Intellias survived because its Polish backups were outside the war zone.
• Offline fallbacks: If the internet goes down or your cloud provider is attacked, can you still operate? Have paper-based processes or local servers that can run disconnected.
• Communication blackout protocols: When attackers hit, they often target phones and email first. Set up encrypted satellite phones or radio backups for key staff.
• Supply-chain resilience: Your software vendors, cloud providers, and internet service providers can all be compromised. Vet them for cybersecurity maturity. Have alternatives lined up.

The Human Factor: Staff Under Siege

Plans are useless without people to execute them. And people under duress make mistakes. Intellias saw this firsthand. Some employees, fearing for their families, accidentally clicked phishing links sent by attackers posing as evacuation coordinators. Others leaked credentials under coercion.

Training for wartime conditions is different from standard cybersecurity awareness. It must address psychological pressure. Teach staff to recognize social engineering that exploits fear — fake military orders, false warnings about family safety, bogus relief fund offers. Run drills that simulate not just a technical breach, but a real-world crisis: no power, no internet, no certainty.

Also, consider legal and HR policies. Can employees work from another country if they flee? Do you have payroll systems that function offline? These aren’t IT questions — they’re business continuity questions that need answers before the crisis hits.

Lessons from the Front Lines

Intellias ultimately recovered. But its CEO told reporters that the company came within hours of total collapse. The attack exposed a gap in most corporate defense strategies: they assume the world stays stable. That assumption is now a liability.

For businesses watching from safe distances, the message is clear. Cyberwarfare is not a future threat. It is the present reality. And the only way to survive it is to build a gameplan that treats war — real, kinetic, digital war — as a plausible scenario. Not just a footnote in a risk register, but a core part of your business continuity planning.

Start today. Audit your backups. Diversify your infrastructure. Train your people. Because when the next conflict goes digital, you don’t want to be the company that thought it was safe.