Ethereum security alert: Swarm users must replace exposed wallet keys

Official software releases carried wallet-stealing malware into Swarm’s ecosystem, prompting a critical Ethereum security alert from SlowMist on November 10, 2026. The supply-chain attack compromised Ethersphere’s bee-js package and Swarm Desktop app, with users urged to remove affected software, install clean versions and replace exposed wallet keys.

Key takeaways

• The poisoned releases were bee-js 13.3.0 and Swarm Desktop 0.56.2.
• An Ethereum smart contract helped attackers manage malware infrastructure.
• Cleanup instructions include backdoor removal and wallet-key replacement, not just software updates.

Ethereum security alert follows compromised releases

Ethersphere’s automated release process was compromised on November 9, 2026, distributing malicious software through official channels. The affected products belong to Swarm, a decentralized storage network within Ethereum’s ecosystem.

The malicious @ethersphere/bee-js 13.3.0 npm package appeared around 00:09 UTC, followed by Swarm Desktop 0.56.2 at roughly 00:36 UTC—about 27 minutes later.

SlowMist said attackers broke into GitHub accounts and abused legitimate release procedures. The release-workflow breach involved either the bee-worker bot or stolen Continuous Integration credentials.

The tampered packages contained postinstall hooks: scripts that execute automatically during installation without another user click. Those scripts contacted an attacker-controlled server and downloaded additional payloads.

A smart contract managed malware infrastructure

SlowMist said the attackers used an Ethereum smart contract as a decentralized command-and-control configuration repository. That let them change the addresses of the servers managing the malware without distributing another malicious software release.

The malware retrieved and executed malicious JavaScript. The same contract had previously been associated with SleepyDuck and EtherDuck, malware campaigns that targeted developers through malicious extensions on the Open VSX marketplace.

Researchers found wallet theft and persistent access

Researchers at Socket and SafeDep independently found malware designed to steal Swarm wallet files and install persistent remote-access tools. Malicious releases could expose wallet credentials and private keys while leaving permanent backdoors on affected systems.

The payloads targeted config.yaml and data-dir/keys/swarm.key. The latter held an encrypted Ethereum keystore, while its unlocking password was stored nearby in plaintext. The files were sent to the attackers.

The research findings identified the goal as draining xDAI and xBZZ tokens, chequebook funds and stake associated with Swarm nodes.

Clean versions and wallet-key replacement

In its Ethereum security warning, SlowMist urged affected users to delete the tainted package right away and revert to bee-js 13.2.0. For those running Swarm Desktop v0.56.2, the guidance was to move to the uncompromised v0.56.3 build instead.

According to GitHub advisory GHSA-hh7j-5m3j-23pf, any system where the tainted package was installed must be assumed “fully compromised.” Ethereum Swarm additionally turned to Discord to push users toward locking down their systems and swapping out the affected desktop build.

Those affected were advised to eliminate backdoors and swap out their wallet keys entirely. Simply applying a software update won’t safeguard assets tied to keys attackers have already captured, nor will it eliminate any persistence mechanisms planted on the device.

Read also: Bhutan’s Ethereum digital identity verifies credentials without putting data on-chain · Ondo brings over 100 US securities to Ethereum: 24/7 access and on-chain pricing

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.