What happened
Vulnerability fixed, payouts without admission of liability
On March 17, 2026, MoreLogin users began reporting cryptocurrency theft. SlowMist founder Yu Xian wrote that same day that around $85,000 had been sent to the attacker’s address, but that there was no evidence yet that MoreLogin was at fault. On March 19–20, MoreLogin itself reported a breach: the attacker gained access to the company’s cloud resources and, on February 6, replaced JavaScript files that the client downloads from its servers. According to the company, from February 6 to March 3, the client could receive malicious code under certain conditions. The code gave the attacker control of the computer, searched for files containing seed phrases and private keys, copied keys from the clipboard, and sent anything it found to the attacker.
Who was affected
101 reports
According to MoreLogin, the affected users were those whose client downloaded the tampered files under certain conditions between February 6 and March 3, 2026. By the time the company published its report on March 19, 101 users had reported theft; a day earlier, it had cited 76. Based on community reports referenced by Yu Xian, the victims were primarily airdrop farmers. The company did not disclose how many clients received the malicious code.
Losses
≈ $85K
According to Yu Xian (SlowMist), around $85,000 was held at the attacker’s address on March 17, and the amount continued to grow. Shortly beforehand, the X user whose post he quoted had cited $60,000. Neither MoreLogin nor SlowMist published the total amount.
What the company did
According to the company, it investigated the incident together with SlowMist, patched the vulnerability, stopped the malicious files from being distributed, and strengthened its security. It advised users to scan their computers with antivirus software and reinstall their operating systems if necessary. On March 26, MoreLogin launched a one-time assistance program: applications were accepted until March 29, and after verification, users received a payment under one of five tiers, ranging from $100 to $5,000. The company stated that this was neither compensation nor an admission of liability, and that the amount did not depend on the losses reported; it did not disclose how many people received payments. SlowMist chief information security officer 23pds wrote that MoreLogin had effectively covered the affected users’ losses in full (SlowMist was investigating at the company’s invitation). In the user agreement version dated March 27, 2026, MoreLogin disclaims liability for the theft of keys and funds resulting from supply-chain attacks and malicious updates; the company did not link this provision to the incident.
Our editors collected and checked the sources; the text says who gives each figure.