New React bug that can drain all your tokens is impacting 'thousands of' websites

Tech

Share

Share this article

Copy linkX (Twitter)LinkedInFacebookEmail

New React bug that can drain all your tokens is impacting 'thousands of' websites

Attackers are using the vulnerability to deploy malware and crypto-mining software, compromising server resources and potentially intercepting wallet interactions on crypto platforms.

By Shaurya Malwa

Updated Dec 16, 2025, 5:25 a.m. Published Dec 16, 2025, 5:25 a.m.

What to know:

• A critical vulnerability in React Server Components, known as React2Shell, is being actively exploited, putting thousands of websites at risk, including crypto platforms.
• The flaw, CVE-2025-55182, allows remote code execution without authentication and affects React versions 19.0 through 19.2.0.
• Attackers are using the vulnerability to deploy malware and crypto-mining software, compromising server resources and potentially intercepting wallet interactions on crypto platforms.

A critical vulnerability in React Server Components is being actively exploited by multiple threat groups, putting thousands of websites — including crypto platforms — at immediate risk with users possibly seeing all their assets drained, if impacted.

The flaw, tracked as CVE-2025-55182 and nicknamed React2Shell, allows attackers to execute code remotely on affected servers without authentication. React’s maintainers disclosed the issue on Dec. 3 and assigned it the highest possible severity score.

STORY CONTINUES BELOW

Don't miss another story.Subscribe to the The Protocol Newsletter today. See all newsletters

Sign me up

By signing up, you will receive emails about CoinDesk products and you agree to our terms of use and privacy policy.

Shortly after disclosure, GTIG observed widespread exploitation by both financially motivated criminals and suspected state-backed hacking groups, targeting unpatched React and Next.js applications across cloud environments.

Loading...

What the vulnerability does

React Server Components are used to run parts of a web application directly on a server instead of in a user’s browser. The vulnerability stems from how React decodes incoming requests to these server-side functions.

In simple terms, attackers can send a specially crafted web request that tricks the server into running arbitrary commands, or effectively handing over control of the system to the attacker.

The bug affects React versions 19.0 through 19.2.0, including packages used by popular frameworks such as Next.js. Merely having the vulnerable packages installed is often enough to allow exploitation.

How attackers are using it

The Google Threat Intelligence Group (GTIG) documented multiple active campaigns using the flaw to deploy malware, backdoors and crypto-mining software.

Some attackers began exploiting the flaw within days of disclosure to install Monero mining software. These attacks quietly consume server resources and electricity, generating profits for attackers while degrading system performance for victims.

Crypto platforms rely heavily on modern JavaScript frameworks such as React and Next.js, often handling wallet interactions, transaction signing and permit approvals through front-end code.

If a website is compromised, attackers can inject malicious scripts that intercept wallet interactions or redirect transactions to their own wallets— even if the underlying blockchain protocol remains secure.

That makes front-end vulnerabilities particularly dangerous for users who sign transactions through browser wallets.

More For You

Protocol Research: GoPlus Security

By CoinDesk Research

Nov 14, 2025

Commissioned byGoPlus

What to know:

• As of October 2025, GoPlus has generated $4.7M in total revenue across its product lines. The GoPlus App is the primary revenue driver, contributing $2.5M (approx. 53%), followed by the SafeToken Protocol at $1.7M.
• GoPlus Intelligence's Token Security API averaged 717 million monthly calls year-to-date in 2025 , with a peak of nearly 1 billion calls in February 2025. Total blockchain-level requests, including transaction simulations, averaged an additional 350 million per month.
• Since its January 2025 launch , the $GPS token has registered over $5B in total spot volume and $10B in derivatives volume in 2025. Monthly spot volume peaked in March 2025 at over $1.1B , while derivatives volume peaked the same month at over $4B.

View Full Report

More For You

Most Influential: Pavel Durov

By Jamie Crawley|Edited by Cheyenne Ligon

14 hours ago

The Telegram CEO may stand as the most pivotal figure in the bona fide mass adoption of cryptocurrency.

Read full story

Latest Crypto News

ARK steps in as crypto stocks extend multi-day selloff

33 minutes ago

Bitcoin, ether and XRP extend losses as year-end caution builds

1 hour ago

Why Dogecoin’s drop below $0.13 is drawing institutional attention

1 hour ago

XRP price weakens at critical level, raising risk of deeper pullback

2 hours ago

Bitcoin, AI stock slide sees over $500 million in bullish bets wiped out

2 hours ago

Why bitcoin ETFs look like they’re falling short, even as their role grows: Asia Morning Briefing

3 hours ago

Top Stories

Bitcoin, ether and XRP extend losses as year-end caution builds

1 hour ago

ARK steps in as crypto stocks extend multi-day selloff

33 minutes ago

Why bitcoin ETFs look like they’re falling short, even as their role grows: Asia Morning Briefing

3 hours ago

Why Dogecoin’s drop below $0.13 is drawing institutional attention

1 hour ago

Bitcoin, AI stock slide sees over $500 million in bullish bets wiped out

2 hours ago

Nasdaq, home of Coinbase, Strategy stocks, seeks 23-hour trading amid investor demand

7 hours ago