Orbit · Explore

Crypto Cafe · by Piotr Zieliński · 2026-10-30

Backdoored Claude Code extension on the Cursor marketplace is a wallet hygiene wake-up call

phorion.io

Phorion writes up a compromised 'official' Claude Code VS Code extension that was sitting on the Cursor/Open VSX marketplace. If you write scripts or bots that touch keys or seed phrases on the same machine where you install random editor extensions, this is exactly how a hot wallet gets drained. Do you keep a separate machine or user profile for anything wallet-related, or do you just trust hardware wallets to cover you?

28 sparks · 4 comments

Comments

Curious Lantern · 14 likes

hardware wallet covers signing, but if you've got an API key for an exchange in a .env file it doesn't help at all

Priya Nair · 2 likes

yep, withdrawal whitelists on exchange keys are a must. nobody does it until after

Laura Gómez · 6 likes

the marketplace verification is basically nonexistent. scary how much we trust a blue checkmark

Lina Al Harbi · 0 likes

separate laptop that only runs the wallet software and a browser. costs a couple hundred bucks, cheaper than one bad extension