- Researchers claim the primary target of a recent cascading supply chain attack was coinbase
- Cryptocurrency exchanging was not compromised but hundreds of other projects may like
- The attack went through a github -action tool
Endgame of the recent cascading supply chain attack on GitHub was to break Coinbase, one of the world’s most popular centralized cryptocurrency exchanges, experts have claimed.
CyberSecurity Researchers Unit 42 (Palo Alto) and Wiz revealed the attack and noted that although Coinbase successfully defended itself, it is difficult to consider the attack as a failure as hundreds of other projects suffered as security injuries.
Coinbase claims that no damage was done – but 218 other depots are believed to have been affected as a result of this attack.
No damage to coinbase
A cascading supply chain attack is a cyberattack where a component compromise, such as a software addiction or tool, triggers a chain reaction that spreads the infringement to multiple connected systems or projects.
In this case, cyber criminals with a small tool, a Github action called Reviewdog/Action-Setup@V1 manipulated. It is a popular tool that helps automate tasks in software projects. How they violated this action was not revealed, but attackers managed to get the tool to leak certain passwords to publicly visible logs.
They then used these codes to inject more malicious code into another widely used tool, called TJ-Actions/Changed Files. This tool is part of Coinbas’s development process, and by doing so they tried to move into Exchange’s cod storage, gain deeper access and create more destruction.
“The striker obtained a GitHub token with writing permits for Coinbase/Agent Kit storage on March 14, 2025, 15:10 UTC, less than two hours before the larger attack began against TJ actions/changed files,” Palo Alto Unit 42 said.
“We followed up by sharing more details about our findings with Coinbase, which stated that the attack did not succeed in causing damage to the Agent Kit project or any other coinbase asset,” the researchers added.
When the threat shoes realized that their attack on Coinbase was not successful, they turned to other projects, the researchers said. We do not know if other attacks were more fertile for the criminals.
Via Bleeping computer
