React bug triggers wallet-draining attacks as hackers hit crypto websites

A critical React Server Components RCE bug is being weaponized to hijack servers, drain crypto wallets, plant Monero miners, and deepen a $3B 2025 theft wave despite urgent patch pleas.​

A critical security vulnerability in React Server Components has prompted urgent warnings across the cryptocurrency industry, as threat actors exploit the flaw to drain wallets and deploy malware, according to Security Alliance.

Security Alliance announced that crypto-drainers are actively weaponizing CVE-2025-55182, urging all websites to review their front-end code immediately for suspicious assets. The vulnerability affects not only Web3 protocols but all websites using React, with attackers targeting permit signatures across platforms.

Users face risk when signing transactions, as malicious code intercepts wallet communications and redirects funds to attacker-controlled addresses, according to security researchers.

React’s official team disclosed CVE-2025-55182 on December 3, rating it CVSS 10.0 following Lachlan Davidson’s November 29 report through Meta Bug Bounty. The unauthenticated remote code execution vulnerability exploits how React decodes payloads sent to Server Function endpoints, allowing attackers to craft malicious HTTP requests that execute arbitrary code on servers, according to the disclosure.

React new versions

The flaw impacts React versions 19.0, 19.1.0, 19.1.1, and 19.2.0 across react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages. Major frameworks, including Next.js, React Router, Waku, and Expo, require immediate updates, according to the advisory.

Patches arrived in versions 19.0.1, 19.1.2, and 19.2.1, with Next.js users needing upgrades across multiple release lines from 14.2.35 through 16.0.10, according to the release notes.

Researchers have found two new vulnerabilities in React Server Components while attempting to exploit the patches, according to reports. These are new issues, separate from the critical CVE. The patch for React2Shell remains effective for the Remote Code Execution exploit, researchers stated.

Vercel deployed Web Application Firewall rules to automatically protect projects on its platform, though the company emphasized that WAF protection alone remains insufficient. Immediate upgrades to a patched version are required, Vercel stated in its December 3 security bulletin, adding that the vulnerability affects applications that process untrusted input in ways that permit remote code execution.

Google Threat Intelligence Group documented widespread attacks beginning on December 3, tracking criminal groups ranging from opportunistic hackers to government-backed operations. Chinese hacking groups installed various malware types on compromised systems, primarily targeting cloud servers on Amazon Web Services and Alibaba Cloud, according to the report.

These attackers employed techniques to maintain long-term access to victim systems, according to Google Threat Intelligence Group. Some groups installed software creating remote access tunnels, while others deployed programs that continuously download additional malicious tools disguised as legitimate files. The malware hides in system folders and automatically restarts to avoid detection, researchers reported.

Financially motivated criminals joined the attack wave starting on December 5, installing crypto-mining software that uses victims’ computing power to generate Monero, according to security researchers. These miners run constantly in the background, driving up electricity costs while generating profits for attackers. Underground hacking forums quickly filled with discussions sharing attack tools and exploitation experiences, researchers observed.

The React vulnerability follows a September 8 attack in which hackers compromised Josh Goldberg’s npm account and published malicious updates to 18 widely used packages, including chalk, debug, and strip-ansi. These utilities collectively account for over 2.6 billion weekly downloads, and researchers have discovered crypto-clipper malware that intercepts browser functions to swap legitimate wallet addresses with attacker-controlled ones.

Ledger CTO Charles Guillemet described that incident as a “large-scale supply chain attack,” advising users without hardware wallets to avoid on-chain transactions. The attackers gained access through phishing campaigns impersonating npm support, claiming accounts would be locked unless two-factor authentication credentials were updated by September 10, according to Guillemet.

Hackers are stealing cryptocurrency and moving it faster, with one laundering process reportedly taking only 2 minutes 57 seconds, according to industry data.

Global Ledger data shows hackers stole over $3 billion across 119 incidents in the first half of 2025, with 70% of breaches involving funds being moved before they became public. Only 4.2% of stolen assets were recovered, as laundering now takes seconds rather than hours, according to the report.

Organizations using React or Next.js are advised to patch immediately to versions 19.0.1, 19.1.2, or 19.2.1, deploy WAF rules, audit all dependencies, monitor network traffic for wget or cURL commands initiated by web server processes, and hunt for unauthorized hidden directories or malicious shell configuration injections, according to security advisories.