Hacker Group from China Exposed for $7 Million Crypto Theft Targeting Wallet Supply Chains

A hacker group in China has allegedly committed a major crypto theft operation amounting to $7 million by targeting wallet supply chains. Posing as a cybersecurity firm, the group was outed after internal disagreements led to a whistleblower leak.

Key Takeaways

A Chinese hacker group masquerading as a cybersecurity firm has reportedly stolen $7 million in digital assets.
The group targeted Trust Wallet and exploited supply chain vulnerabilities in various crypto wallets.
Internal disputes among group members led to a whistleblower revealing their tactics and operations.
This incident highlights significant security risks associated with wallet supply chains and extensions.
Users should practice rigorous security measures and conduct regular supply chain audits for better protection.

China hacker group wallet supply‑chain attack diagram

Article Content

A group of hackers from China, who falsely identified themselves as a cybersecurity firm, has come under scrutiny after allegedly stealing $7 million through wallet supply-chain attacks. Reports indicate that the group, which targeted well-known wallet provider Trust Wallet and others, experienced an internal conflict that culminated in a whistleblower leak detailing their criminal operations.

Operating under the guise of Wuhan Anshun Technology, this group presented itself as a legitimate security company engaged in vulnerability research, as well as network offensive and defensive operations. Behind the facade, however, the group was reportedly involved in a “gray market” scheme, systematically stealing mnemonic phrases and accessing user wallets across multiple blockchain networks. According to the whistleblower, the hackers used automated tools to bulk-scan assets linked to mnemonic phrases and locate valuable portfolios on Ethereum, BNB Chain, Arbitrum, and other platforms.

The leaked information reveals that the group exploited vulnerabilities in Electron-based clients and browser plugins, utilizing reverse engineering and remote-control software to steal wallet data and siphon funds. Their operations were said to involve 37 different token types from various blockchains, with laundered funds being divided and transferred to obscure their origins. The reason for their exposure appears to be an internal squabble regarding profit sharing and unresolved severance payments for one of the operators.

The whistleblower stated that they had arguments with the team leader over perceived unfair profit distributions. Eventually, they decided to leak evidence of the operation after not receiving promised compensation, expressing intent to cooperate with law enforcement. As of now, authorities have not officially confirmed these allegations or provided updates on any investigations. Industry experts believe this incident emphasizes the inherent security vulnerabilities within wallet supply chains, plugin ecosystems, and desktop clients, particularly affecting high-value users who may be too complacent with self-custody software.

For both retail and institutional users, the message is clear: security risks extend beyond handling private keys. They are present in every update, browser extension, and client wrapper that stands between users and their keys. In a landscape where hackers may construct fake “security companies” as a ruse, the importance of conducting thorough supply-chain audits, limiting the number of plugins used, and maintaining strict device hygiene is more crucial than ever for the survival of digital assets.