Share this article
CoinMarketCap Briefly Exploited With Wallet Phishing Pop-Up Message
The company has not disclosed how many users were affected or whether any wallets were compromised as a result of the exploit.
Jun 21, 2025, 3:28 p.m.
Make us preferred on Google
What to know:
- Hackers exploited a vulnerability in CoinMarketCap's front-end system by using a doodle image to inject malicious code.
- The code triggered fake wallet verification pop-ups across the site, instructing users to "Verify Wallet" in a phishing tactic to gain access to their crypto holdings.
- CoinMarketCap's team removed the pop-up shortly after discovery and has implemented measures to isolate and mitigate the issue.
Hackers exploited a vulnerability in CoinMarketCap’s front-end system, using a seemingly harmless doodle image to inject malicious code that triggered fake wallet verification pop-ups across the site.
The breach, confirmed by CoinMarketCap, used its backend API to deliver a manipulated JSON payload that embedded JavaScript into the homepage according to blockchain security firm Coinspect Security.
STORY CONTINUES BELOW
On June 20, 2025, our security team identified a vulnerability related to a doodle image displayed on our homepage. This doodle image contained a link that triggered malicious code through an API call, resulting in an unexpected pop-up for some users when visited our homepage.…
— CoinMarketCap (@CoinMarketCap) June 21, 2025
The script caused an unauthorized prompt instructing users to “Verify Wallet,” a phishing tactic aimed at tricking visitors into handing over access to their crypto holdings.
The blockchain security firm traced the attack to the platform’s rotating “doodles” feature, which allowed attackers to embed the malicious code without altering the site’s core infrastructure.
The pop-up was live for a short period before being removed by CoinMarketCap’s team.
“Upon discovery, we acted immediately to remove the problematic content,” CoinMarketCap said in a statement posted to social media. “Comprehensive measures have been implemented to isolate and mitigate the issue.”
CoinMarketCap has not disclosed how many users encountered the pop-up or whether any wallets were compromised.
More For You
Pudgy Penguins is building a multi-vertical consumer IP platform — combining phygital products, games, NFTs and PENGU to monetize culture at scale.
What to know:
Pudgy Penguins is emerging as one of the strongest NFT-native brands of this cycle, shifting from speculative “digital luxury goods” into a multi-vertical consumer IP platform. Its strategy is to acquire users through mainstream channels first; toys, retail partnerships and viral media, then onboard them into Web3 through games, NFTs and the PENGU token.
The ecosystem now spans phygital products (> $13M retail sales and >1M units sold), games and experiences (Pudgy Party surpassed 500k downloads in two weeks), and a widely distributed token (airdropped to 6M+ wallets). While the market is currently pricing Pudgy at a premium relative to traditional IP peers, sustained success depends on execution across retail expansion, gaming adoption and deeper token utility.
More For You
Bitcoin's Quantum threat is ‘real but distant,’ says Wall Street analyst as doomsday debate rages on
Wall Street broker Benchmark argued the crypto network has ample time to evolve as quantum risks shift from theory to risk management.
What to know:
- Broker Benchmark said Bitcoin’s main vulnerability lies in exposed public keys, not the protocol itself.
- Coinbase’s new Quantum Advisory Council marks a shift from theoretical concern to institutional response.
- Bitcoin’s architecture is conservative but adaptable, according to Benchmark analyst Mark Palmer, with a long runway for upgrades.
Top Stories
