SeaFlower: A Highly Sophisticated Web3 Wallet Hack Targeting Cryptocurrency Users A newly uncovered cyber threat campaign, SeaFlower (藏海花), has been targeting users of popular Web3 cryptocurrency wallets with advanced backdoor attacks designed to steal seed phrases and drain funds. Discovered by Confiant analysts, this operation is among the most technically sophisticated threats to Web3 users documented to date, leveraging reverse engineering, app cloning, and covert data exfiltration. ### Targets and Tactics SeaFlower focuses on four major wallets Coinbase Wallet, MetaMask, TokenPocket, and imToken across iOS and Android. The malicious apps are pixel-perfect replicas of legitimate versions, making detection nearly impossible for users. The campaign’s infrastructure, including domains registered under .cn TLDs and Alibaba CDN abuse, points to Chinese-speaking threat actors, with source code comments, developer usernames, and modding frameworks tied to the region. Victims are lured through cloned download sites promoted via Chinese search engines like Baidu, Sogou, 360 Search, and Shenma. These fake sites mimic official wallet pages, complete with fabricated ratings and download counts, tricking users into installing trojanized apps. ### How the Backdoor Works Once installed, the backdoored wallets function normally while silently executing malicious code: - iOS: The attack begins with a provisioning profile download, allowing the app to bypass Apple’s App Store security. An injected .dylib file hooks into the app’s runtime using tools like Cydia Substrate and MonkeyDev, intercepting the dataWithContentsOfFile:options:error function when MetaMask loads its JavaScript bundle. An obfuscated class (FKKKSDFDFFADS) decrypts an RSA-encrypted payload, exfiltrating seed phrases, wallet addresses, and balances to attacker-controlled domains (e.g., trx.lnfura[.]org, mimicking Infura). - Android: For Coinbase Wallet, malicious smali code in a class named XMPMetadata triggers an HTTP POST request when a seed phrase is saved, sending data to colnbase[.]homes/u/sms/. ### Attribution and Impact The campaign’s name derives from a leaked macOS username (“Zhang Haike”), referencing a character in the Chinese novel Tibetan Sea Flower. Additional usernames (“lanyu” and “trader”) further link the operation to a single threat actor. The attack’s sophistication combining app modding, automated deployment, and stealthy exfiltration highlights a significant escalation in Web3-targeted threats. With no visible red flags during normal use, SeaFlower represents a high-risk threat to cryptocurrency users, particularly those relying on third-party download sources. The campaign underscores the growing complexity of attacks against decentralized finance (DeFi) platforms.