Malicious NuGet Packages Pose as Nethereum, Steal Crypto Wallet Keys
Socket's Threat Research Team has identified a sophisticated supply chain attack targeting cryptocurrency developers through the NuGet package registry.
Socket's Threat Research Team has identified a sophisticated supply chain attack targeting cryptocurrency developers through the NuGet package registry.
The malicious packages are designed to exfiltrate sensitive wallet data, including private keys and mnemonics. The attack exploits a package named Netherеum.All, which closely resembles the legitimate Nethereum library. The key difference is the use of a Cyrillic "e" (U+0435) in the package name, creating a homoglyph that appears identical to the Latin "e" upon casual inspection.
This attack takes advantage of NuGet’s permissive Unicode naming rules, which, unlike other package registries, do not enforce ASCII-only identifiers. Attackers have published malicious packages impersonating Nethereum, a standard .NET library for Ethereum development, by employing homoglyph typosquatting tactics.
Major package registries such as npm, PyPI, and Maven Central enforce ASCII-only naming conventions, providing additional security against such attacks.
Nethereum, widely adopted with extensive downstream dependencies, became an attractive target for attackers aiming to compromise developer environments and CI/CD pipelines. The malicious package was published on Mon, Oct 16, 2025, and reported to NuGet on Wed, Oct 18, 2025. NuGet responded by removing the package and suspending the associated publisher account on Fri, Oct 20, 2025. However, this four-day window allowed for potential compromises.
Socket's Threat Research Team has identified a sophisticated supply chain attack targeting cryptocurrency developers through the NuGet package registry.
The attackers artificially inflated download counts to lend credibility to the malicious package. Within days, Netherеum.All displayed 11.6 million downloads, achieved through automated scripts that manipulated download metrics.
This artificial popularity significantly influences search ranking algorithms, increasing the likelihood of developers encountering the malicious package first.
The core malicious functionality is contained within a method called EIP70221TransactionService.Shuffle, which uses XOR encryption to conceal its command-and-control (C2) endpoint until runtime. The endpoint is revealed only when invoked, sending sensitive data such as mnemonics and private keys to attacker-controlled servers.
The malicious package includes legitimate references to Nethereum libraries, ensuring infected applications function normally while exfiltrating wallet data.
This campaign is the second iteration of a coordinated attack against NuGet's Ethereum ecosystem. The package Netherеum.All is linked to a prior typosquat named NethereumNet, sharing similar exfiltration techniques and malware codebase. Both packages were published by the same threat actor using different aliases, indicating persistence despite takedowns.
Developers who installed these packages should assume compromised secrets and take immediate action to rotate private keys and mnemonics. Organizations should enforce stricter dependency hygiene practices and consider adopting ASCII-only naming conventions to mitigate homoglyph attack risks.
Based on reporting by GBHackers.