A NullMeridian record Andromeda Logs

NullMeridianLog

24 Jul 2025, from 13:50 UTC+8

WOO X: Dev-Machine Backdoor Led to $14M Unauthorized Withdrawals

WOO X: on 24 Jul 2025 a socially engineered backdoor on a developer MacBook let an attacker replace credentials for nine accounts and withdraw $14M. Users compensated from treasury; WOO attributes UNC4899/Lazarus.

  • Event date
  • Incident typeExchange account compromise
  • Bug classSocial engineering
  • Published

Loss, as sourced

$14 million in unauthorized withdrawals from 9 user accounts across Bitcoin, Ethereum, BNB and Arbitrum, per WOO X. 100% user compensation from WOO treasury.

Traceability

Primary sources

  1. 01woox.ioWOO X July 24th Security Incident Post-Mortem, 19 Aug 2025 (opens in a new tab)

In brief

Root cause: Per WOO X: open-source forum lure; developer opened a project file that deployed a hidden backdoor; attacker used the VPN session into GCP/GKE, escalated via a malicious pod/service-account token, then on 24 Jul replaced emails/passwords/2FA for 9 accounts and withdrew.

Timeline, as sourced: Per WOO X: 28 Jun approach; 8 Jul file opened; 9–11 Jul GCP/GKE access and backdoor; quiet until 24 Jul 13:50 UTC+8 withdrawals; 15:40 containment; withdrawals suspended; full infra migration followed.

Account, as sourced

Claimed (WOO X) (post-mortem (opens in a new tab)): evidence points to UNC4899 (Lazarus/TraderTraitor/Jade Sleet). Trading remained up.

Claimed (WOO X): engaged Seal911, zeroShadow, Hypernative, Verichains, Hacken.

Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.

Permalinkhttps://andromeda.observer/e/woo-x-dev-backdoor-withdrawals-2025