React vulnerability hits crypto websites with drainers

A vulnerability found in one of the most popular JavaScript libraries for building websites, React Server Components, has also affected websites in the crypto industry.

Security researchers from the Security Alliance (SEAL) warned that they're observing "a big uptick in drainers" that are being uploaded to legitimate crypto websites through exploitation of the React vulnerability CVE-2025-55182.

"All websites should review front-end code for any suspicious assets NOW," researchers urged, adding that at risk are all websites, not only those of Web3 protocols, and users must be careful when signing any crypto-related permit signature.

SEAL advised teams to scan hosts for CVE-2025-55182 and check whether their code is suddenly loading assets from hosts they don't recognize. Next, teams should check whether any of the "Scripts" loaded by their code are obfuscated JavaScript, while also verifying whether the wallet is showing the correct recipient on the signature signing request.

As reported by Cybernews, the React vulnerability, which enables external attackers to run privileged, arbitrary code on servers without any authorization, was disclosed on December 3rd. Meanwhile, last Friday, React and Next.js disclosed two additional follow-up vulnerabilities.

The uptick in drainers, aided by the React vulnerability, is happening at a time when crypto-stealing drainer operators and affiliates are testing new ways to stay undetected and exploit crypto wallets. Drainer affiliates are now leveraging high-reputation domains for landing pages and payload hosting, re-registering previously legitimate domains, and deploying advanced fingerprinting.

The drainer-as-a-service (DaaS) model and the broader drainer ecosystem have also evolved significantly, as many drainer operators are now adopting this approach.

In a separate crypto crime story, on Sunday, DeFi protocol Aevo (formerly Ribbon Finance) confirmed that its vaults were drained to the tune of $2.3 million.

DeFi developer Anton Cheng suggested that the hack was mainly triggered by an upgraded oracle code that allowed anyone to set prices for new assets.

Unlock more exclusive Cybernews content on YouTube.