Cryptocurrency Developers Targeted by NuGet Supply Chain Attack

Socket’s Threat Research Team discovered a sophisticated supply chain attack on the NuGet package registry targeting cryptocurrency developers. The malicious package, Netherеum.All, exploited a homoglyph attack by using a Cyrillic 'e' to impersonate the legitimate Nethereum library. This package exfiltrated sensitive wallet data, including private keys and mnemonics. The attack leveraged NuGet’s permissive Unicode naming rules, which do not restrict identifiers to ASCII characters. The malicious package was published on October 16, 2025, and removed by NuGet on October 20, 2025. The attackers also inflated download counts to make the package appear legitimate. Researchers linked this attack to an earlier typosquat named NethereumNet, indicating a persistent threat.