Rogue AI Code Assistant Targets Ethereum Developer, Steals Crypto Funds - Crypto Economy

TL;DR

• Ethereum core developer Zak Cole lost a small amount of Ether after a malicious AI-powered extension, “contractshark.solidity-lang,” exfiltrated his private key from a “.env” file.
• The attack highlights the growing risk of wallet drainers disguised as legitimate VS Code and browser extensions, some available as cheap software-as-a-service.
• Despite the loss, Cole’s use of isolated testing wallets and hardware wallets prevented major financial damage, showing good security practices can still mitigate evolving threats.

Ethereum core developer Zak Cole recently experienced a sophisticated crypto wallet-draining attack involving a rogue AI code assistant. Cole installed the “contractshark.solidity-lang” extension, which appeared legitimate with professional design and over 54,000 downloads, but secretly transmitted his private key to an attacker’s server. Over three days, the attacker gained access to his hot wallet before draining the funds.


Cole reported the loss on X, noting it amounted to only a few hundred dollars in Ether due to his careful use of small, project-specific wallets. The incident also highlights how even experienced developers can be deceived by increasingly polished and realistic-looking tools.

Extensions Become Major Attack Vector For Crypto Builders

Malicious VS Code and browser extensions are increasingly recognized as major attack vectors, according to Hakan Unal, senior security operations lead at blockchain security firm Cyvers. Threat actors use tactics like fake publishers, typosquatting, and professional-looking copy to trick developers into granting access to private keys. Wallet drainers are now even sold on a software-as-a-service basis, sometimes renting for as little as $100 USDt, making attacks accessible to a wider range of scammers. These developments suggest that the barrier for entry into crypto-targeted cybercrime is lower than ever, allowing even less technical attackers to compromise wallets successfully.

Historical Incidents Highlight Persistent Risks

This incident follows similar attacks, including a September 2024 WalletConnect Protocol scam that stole over $70,000 from investors while masquerading as a legitimate app on Google Play for more than five months. Fake reviews were used to mimic genuine feedback, illustrating the lengths attackers go to exploit trust. Experts recommend vetting all third-party extensions, avoiding storing secrets in plain text, using hardware wallets, and developing in isolated environments to reduce exposure.


Cole’s experience demonstrates that even highly experienced blockchain developers are not immune to emerging threats. Nevertheless, by adhering to strong security practices, crypto professionals can limit their risk, protect major holdings, and continue innovating confidently in the blockchain space. As attackers adopt AI-driven tactics and scalable SaaS models, vigilance and proper safeguards remain essential for anyone interacting with digital assets, whether for development, investment, or experimental testing purposes.