Beware! North Korean hackers have infiltrated the Waves Wallet codebase and may steal user Private Keys.

[Coin World] Coin World reported on June 19 that a North Korean developer gained elevated access to the Keeper-Wallet code repository of Waves Protocol. The account “AhegaoXXX” has been pushing updates to the dormant code repository since May 2025, and this account has been confirmed to be linked to a North Korean IT outsourcing organization. Code review found that one submission added functionality to send wallet logs and runtime errors to an external database, potentially stealing the mnemonic phrase and Private Key. Although this branch has not been merged, the attacker has published six long-unupdated malicious NPM packages by controlling the account of former Waves engineer Maxim Smolyakov. The security report points out that this incident shows North Korean hackers have shifted from ordinary outsourcing infiltration to direct control of the code repository. It is recommended that the development team strengthen Supply Chain defenses, including auditing contributor permissions, cleaning up dormant accounts, and monitoring repository redirections. Currently, the affected software’s download volume is low, but Waves users updating the Keeper-Wallet are at risk of credential leakage.