Swarm Malware Attack: Malicious Update Exposed Node Wallet Keys

Swarm Malware Attack: Hijacked bee-js Update Steals Node Wallet Keys

A routine update became a wallet thief. Ethereum Swarm says bee-js 13.3.0 and Swarm Desktop 0.56.2, published on November 9, were malicious. They stole the node key and installed remote access. This Swarm malware attack report explains who is affected and what to do.

Ethereum itself was not reported compromised. The attackers abused Swarm's software release path.

What Happened on November 9

Reports say attackers used Ethersphere's own release workflow, so the packages looked legitimate. Whether a bot account or stolen CI credentials was used was not officially confirmed.

The code reads two files: config.yaml and data-dir/keys/swarm.key. The key is an encrypted Ethereum keystore. Desktop stores its password in plain text in the config. Together, the files can expose the node wallet. Remote access was also installed. The script ran automatically on install, even if the library was never used. The GitHub advisory says any computer with the package installed or running should be treated as fully compromised.

Security firms counted about 65 program downloads and about 10 Swarm library fetches by early morning, including researchers. No confirmed tally of infections or losses exists.

Swarm Malware Attack: Who Is Affected and What to Do Now

bee-js is the JavaScript library behind Swarm Desktop and swarm-cli. If you updated, act now:

• Do not install other program versions for now. Reinstall 0.56.1 from desktop.ethswarm.org

• If 0.56.2 ever ran, treat the key and password as stolen

• Move funds and stake to a new key made on a clean device

• Check bee-desktop.log for "Bee Desktop version: 0.56.2"

• Rebuild the host and remove persistence, using the steps in Swarm's Discord notice

Developers should pin bee-js 13.2.0 and review lockfiles. Node wallets holding BZZ or staked funds are the exposure. No losses are confirmed.

What the Compromise Means for Swarm Developers and Node Users

Two readings exist. Fast detection limited the damage: bee-js 13.3.0 was flagged within minutes and downloads were few. But the build came through official channels with valid provenance, so trust signals did not stop it.

One report also linked the attackers' infrastructure to an blockchain network smart contract. That is unverified. A supply-chain attack hides malware inside software people already trust. For any Swarm malware attack victim, the fix is replacing keys, not only updating software.

Developers in India and elsewhere who use Swarm library should audit installs and watch Ethersphere's official fix.

The Bottom Line

This Swarm malware attack hit two official releases for under a day. Check versions, rotate keys if 0.56.2 ran, and follow Ethereum Swarm's notices for any fixed release.

YMYL Disclaimer: This article is for information purposes only and is not financial, investment, security or trading advice. Information is based on Ethereum Swarm's X security notices, public security-firm analyses and a GitHub advisory, as of November 10, 2026. The Discord removal steps, the advisory itself and individual infections were not independently verified. Versions, fixes and loss figures can change. Follow Ethereum Swarm's official instructions and consult a security professional. No wrongdoing by Ethereum Swarm is alleged or implied. Crypto assets are volatile and carry risk of loss, including full loss of funds. Always verify current details directly with official sources and consult a licensed advisor before making decisions.