Ethereum developer became a victim of malicious AI extension.

# Ethereum developer became a victim of malicious AI extension

One of the key developers of Ethereum, Zak Cole, became a victim of a cryptocurrency drainer. The attackers stole the private key from his hot wallet.

I've been in crypto for over 10 years and I’ve Never been hacked. Perfect OpSec record.

Yesterday, my wallet was drained by a malicious @cursor_ai extension for the first time.

If it can happen to me, it can happen to you. Here’s a full breakdown. 🧵👇

— zak.eth (@0xzak) August 12, 2025

"I have been in the crypto industry for over 10 years, and I have never been hacked. An impeccable security reputation. However, yesterday my wallet was drained for the first time by an AI assistant drainer called Cursor," he wrote.

Koul installed the contractshark.solidity-lang extension without noticing anything suspicious. It had a professional icon design, a detailed description, and over 54,000 downloads.

However, the plugin secretly copied the developer's .env file, which contained the private key, and sent it to the attackers' server. For three days, the hackers had access to Cole's wallet, but they only withdrew the funds on August 10.

According to the victim, the losses amounted to "several hundred" dollars in Ethereum. The developer keeps the majority of the funds in hardware wallets.

Cole noticed a notification about a funds transfer. It was then that he realized he had been hacked. After studying reports from Kaspersky Lab and other cybersecurity companies, the Ethereum developer discovered that the drainer is part of a campaign in which attackers have already stolen over $500,000.

He also pointed out the "red flags" that he did not pay attention to when installing the extension:

• unofficial creator;
• absence of a link to GitHub;
• a large number of downloads and zero reviews;
• recent upload date - July 2025;
• imitation of the name of a well-known extension

"Haste = ignoring instincts," Cole emphasized.

He advised users who have been hacked to change all their keys, check Etherscan for unauthorized transactions, revoke all permissions, create new wallets, and document the incident.

We remind you that in May, hackers created a malicious clone of Ledger Live for macOS. The attackers replaced the official application with a fake one that collected seed phrases and drained wallets.

In April, it became known that operators of software for stealing cryptocurrency started renting out their tools. Beginner scammers can rent a set of necessary tools for a one-time fee of $100-300.