React Vulnerability Triggers Wallet-Draining Attacks on Crypto Websites

A critical security flaw in React Server Components has led to dire warnings throughout the cryptocurrency sector, as cybercriminals exploit this vulnerability to drain wallets, deploy malware, and even mine Monero. This situation emerges amidst a wave of thefts in 2025, totaling $3 billion, according to Security Alliance.

Key Takeaways

A severe React Server Components vulnerability is prompting urgent calls for patching.
Cyber attackers are exploiting this flaw (CVE-2025-55182) to manipulate crypto wallet transactions.
Users could unknowingly fall victim while signing transactions due to malicious code.
Immediate updates to React or Next.js are vital for web safety.
The crypto community is seeing widespread attacks, with significant monetary losses in the first half of 2025.

React RCE bug enables crypto wallet drains and Monero mining

Understanding the Vulnerability

The React Server Components vulnerability has gained attention as hackers utilize it to hijack servers and steal funds. Security Alliance warned that the flaw, identified as CVE-2025-55182, is being actively weaponized, and all websites using React are urged to examine their front-end code for anything suspicious. This flaw affects Web3 protocols and various sites built on React, with attackers particularly targeting transaction signatures.

When users sign transactions, malicious code can intercept these communications and redirect funds to addresses controlled by the attackers, as indicated by security experts.

Recent Developments and Patching

React’s team revealed CVE-2025-55182 on December 3, assigning it a critical CVSS score of 10.0 after a report from Lachlan Davidson was submitted to the Meta Bug Bounty program on November 29. The flaw takes advantage of how React decodes payloads sent to Server Function endpoints, allowing attackers to create harmful HTTP requests that can execute arbitrary code on servers.

Affected React Versions

The vulnerability impacts several React versions, including 19.0, 19.1.0, 19.1.1, and 19.2.0, across various packages such as react-server-dom-webpack and react-server-dom-parcel. Essential frameworks like Next.js, React Router, Waku, and Expo must receive immediate updates.

Patches have been rolled out in versions 19.0.1, 19.1.2, and 19.2.1, and Next.js users should upgrade across multiple release lines from 14.2.35 to 16.0.10, per the release updates.

Security researchers have discovered two additional vulnerabilities while investigating the patch deployment. These are distinct from the critical CVE-2025-55182. Fortunately, the patch for React2Shell remains effective for the Remote Code Execution exploit.

Ongoing Attacks and Malware Deployment

Vercel, the platform hosting many React projects, implemented Web Application Firewall (WAF) rules to offer automatic protection. Nevertheless, the company cautioned that relying solely on WAF for security is inadequate, stressing the importance of swiftly updating to the patched versions.

From December 3 onwards, the Google Threat Intelligence Group reported escalating attacks, noting that various cybercriminal groups, including state-backed organizations, are involved. Chinese hacking cells are predominantly targeting cloud servers on Amazon Web Services and Alibaba Cloud with multiple malware forms.

Some of these attackers installed software that allows for long-term access to compromised systems, using tactics like creating remote access tunnels or downloading additional malware disguised as legitimate files. This malware often hides within system folders and has self-restarting capabilities to avoid detection.

Financially motivated hackers joined the attack wave on December 5, introducing crypto-mining software that exploits victims’ computing resources to generate Monero. This mining runs in the background, increasing electricity bills while allowing attackers to reap the profits. Underground forums are buzzing with discussions on attack strategies and available tools.

Previous Incidents and Advice for Users

This vulnerability comes on the heels of a significant incident on September 8, when hackers compromised the npm account of Josh Goldberg, distributing malicious updates to 18 popular packages, which include well-known ones like chalk and debug. These packages collectively account for over 2.6 billion downloads weekly, highlighting their widespread use. Researchers have also identified crypto-clipper malware that swaps legitimate wallet addresses with those controlled by attackers.

Ledger's CTO, Charles Guillemet, labeled this incident a “large-scale supply chain attack,” advising users without hardware wallets to avoid on-chain transactions. The attackers used phishing campaigns masquerading as npm support, claiming accounts would be locked unless two-factor authentication credentials were updated.

Currently, hackers are becoming more efficient at stealing cryptocurrency, with reports indicating that laundering processes can be completed in just 2 minutes and 57 seconds.

According to global Ledger data, hackers have amassed more than $3 billion through 119 incidents in the first half of 2025, with 70% of the stolen funds being moved before the breaches became public knowledge. Alarmingly, only 4.2% of the stolen assets were recovered.

Recommendations for React Users

Organizations utilizing React or Next.js should immediately upgrade to versions 19.0.1, 19.1.2, or 19.2.1, implement WAF rules, conduct audits on all dependencies, monitor for unexpected wget or cURL commands initiated by web processes, and search for unauthorized hidden directories or malicious configuration injections according to security advisories.