The cryptocurrency industry's newest darlings are learning an old lesson: speed and user experience improvements mean nothing if attackers can simply steal your keys. A coordinated malware campaign dubbed TrapDoor is actively targeting wallet data across Solana, Sui, and Aptos—three blockchains that have positioned themselves as the technically superior successors to Ethereum's clunky infrastructure.
The attack vector is elegant in its simplicity. Rather than exploiting smart contract vulnerabilities or consensus mechanisms, TrapDoor embeds malicious code in developer packages, harvesting private keys from users who interact with compromised applications. It's a supply-chain attack, the kind that security researchers have warned about for years but that crypto's move-fast culture consistently underestimates.
The new chains' old problem
Solana, Sui, and Aptos share more than high throughput and venture capital enthusiasm. All three have attracted developers fleeing Ethereum's gas fees and congestion, building wallets and applications at a pace that sometimes outstrips security auditing. TrapDoor exploits precisely this gap—the space between a project's launch and its maturation into battle-tested infrastructure.
The irony is thick. These chains marketed themselves partly on security improvements: Move-based languages for Sui and Aptos that prevent certain classes of bugs, Solana's parallel transaction processing that reduces attack surfaces. None of that matters when the vulnerability sits in the npm packages developers use to build their front ends.
Supply-chain attacks scale beautifully
What makes TrapDoor particularly concerning is its efficiency. A single compromised package can propagate across dozens of applications, each one potentially exposing thousands of users. The attackers don't need to find a flaw in Solana's runtime or Sui's consensus—they just need one careless dependency in a popular wallet's build process.
This isn't the first supply-chain attack on crypto infrastructure, and it won't be the last. The Ledger Connect Kit compromise in 2023 demonstrated how a single library could drain funds across multiple decentralized applications. TrapDoor suggests attackers have refined the playbook and are now targeting the ecosystems with the most momentum—and perhaps the least institutional paranoia.
Our take
The crypto industry's obsession with on-chain security has created a blind spot for off-chain vulnerabilities. Solana, Sui, and Aptos have invested heavily in making their protocols robust, but protocols don't get hacked—implementations do. Until these ecosystems develop the same paranoid security culture that Bitcoin maximalists have cultivated over fifteen years, attacks like TrapDoor will keep finding soft targets. The next-gen chains are learning that being newer doesn't mean being safer; it often means the opposite.
