Hacker Slips Malicious Code Into Ethereum Dev Tool ETHcode

Crypto News Exploits

Written by Aaron S.,

Editor-In-Chief

Last Updated: July 11, 2025

Key Takeaways

A hacker under the name Airez299 added hidden malicious code to ETHcode, an open-source Ethereum developer toolkit;
The harmful code bypassed reviews by both GitHub’s AI and the ETHcode team, who requested only minor changes;
The code triggered a script likely meant to steal crypto or disrupt Ethereum projects on affected machines.

Stop overpaying - start transferring money with Ogvio. Join the waitlist & grab early Rewards NOW! 🎁

Hacker Slips Malicious Code Into Ethereum Dev Tool ETHcode

BITDEGREE IN YOUR SOCIAL FEED

Cybersecurity researchers at ReversingLabs recently found that a hacker injected harmful code into ETHcode, a toolset for Ethereum ETH $3,005.61 developers.

ETHcode is a VS Code extension that helps developers build and test Ethereum-compatible smart contracts and apps.

The suspicious code was added on June 17 by a GitHub user named Airez299, who had no earlier contributions to the project.

What is VeChain? VeChain Coin Explainer (ANIMATED)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

The update included 43 separate changes and about 4,000 edited lines, which mainly described a new testing system and additional features. Inside this large batch, two lines of malicious code were hidden.

The update was reviewed by GitHub’s automated AI tool and also checked by 7finney, the team that manages ETHcode. Neither spotted the problem, and only small edits were requested before approval.

According to ReversingLabs, the harmful code was disguised in a way that made it hard to notice. The first line was placed in a file with a name almost identical to an existing one and written in a scrambled style to make it harder to read.

The second line was designed to activate the first. When triggered, it launched a PowerShell script that downloaded and ran a batch file from a public file-sharing site.

ReversingLabs noted that it was likely designed to steal cryptocurrency stored on the victim’s computer or interfere with Ethereum projects being developed using the tool.

Recently, Sentinel Labs discovered a hacking campaign linked to groups in North Korea that uses malware called NimDoor. How does the malware work? Read the full story.