Zerion Disables Web App After $100K Internal Wallet Breach

• Zerion lost about $100K after an AI-driven attack compromised internal hot wallets.
• No user funds or apps were affected as the breach was limited to internal systems.
• Web app taken offline while credentials rotated and attacker wallets traced.

Zerion has temporarily disabled its web application following the detection of unusual activity associated with a targeted cyberattack. This breach resulted in the loss of approximately $100,000 from the company’s internal hot wallets.

The incident, which the company attributed to an AI-driven social engineering operation linked to a threat actor associated with North Korea, compromised a team member’s device and exposed specific credentials and access to wallets. The company stated that the breach did not impact user funds, applications, or infrastructure, and confirmed that its web platform would remain offline for up to 48 hours as a precautionary measure.

Attack Linked to Compromised Device and Credentials

According to Zerion, the attack originated from a compromised device belonging to a team member who was targeted via social engineering. The method enabled the attacker to access logged-in sessions, sensitive credentials, and private keys associated with internal hot wallets used for testing and operational purposes.

The company reported that the financial impact was limited to internal funds, totaling roughly $100,000 across multiple wallets. Zerion added that existing security controls and internal response prevented further misuse of the compromised access.

No Impact on Users or Core Infrastructure

Zerion confirmed that no user funds were affected, noting that its wallet operates under a self-custodial model in which users retain full control over their private keys and seed phrases. The company also stated that its mobile applications, browser extensions, backend infrastructure, and API services were not impacted by the breach.

In addition, Zerion reported that its communication channels, including social media accounts, remained secure throughout the incident. In addition, the company noted that its application builds are isolated, limiting exposure across different platforms.

Following detection of the breach, Zerion implemented a series of containment actions. The company secured its deployment infrastructure to prevent unauthorized updates, rotated all potentially compromised credentials, and reconfigured multi-signature accounts.

The web application was placed into maintenance mode to reduce the risk of malicious deployment, while all employees were instructed to scan their devices for similar malware. Zerion also reviewed access points across its systems and initiated credential resets where necessary.

To address the broader threat, Zerion engaged external security partners, including Blockaid, ZeroShadow, and ChainPatrol, to track and flag attacker-controlled wallets. The company confirmed that the stolen funds had been traced to specific addresses and reported to law enforcement authorities.

Related: Trust Wallet Chrome Extension Breach Drains Over $6M in User Funds