Make a title for this article (do not wrap in quotes or use semicolon or weird characters):

The LottieFiles' Lotti-Player project recently fell victim to a supply chain attack, leading to the insertion of a crypto drainer on websites, which targets and steals cryptocurrency from visitors.

Blockchain threat monitoring service, Scam Sniffer, has reported that this breach resulted in at least one individual losing approximately $723,000 in Bitcoin following the LottieFiles supply chain attack.

Yesterday, after users flagged unusual code injections, it was discovered that versions 2.0.5, 2.0.6, and 2.0.7 of the Lottie Web Player ("lottie-player") were modified to embed malicious code. This code introduced a crypto wallet drainer to websites.

These drainers are harmful scripts embedded in sites that prompt users to connect their cryptocurrency wallets. Unfortunately, when a user connects their wallet, the script attempts to "drain" or steal all cryptocurrency assets and NFTs, transferring them to the attackers.

In response, LottieFiles promptly released version 2.0.8, based on the unaffected 2.0.4 version, advising users to update immediately.

LottieFiles CTO, Nattu Adnan, explained, "A significant number of users accessing the library via third-party CDNs without version pinning were automatically served the compromised version as the latest release. The safe version has now been published, resolving the issue for these users."

Those unable to upgrade should alert end users to the potential risks and fraudulent cryptocurrency wallet connection attempts. Alternatively, staying on version 2.0.4 is recommended.

LottieFiles is a SaaS platform that facilitates the creation and sharing of scalable, vector-based animations, easily embedded in apps and websites. It is well-regarded for enabling high-quality visuals with minimal impact on device performance, particularly on mobile and web apps.

Developers using the Lottie-Player script reported a supply chain attack, resulting in some websites displaying prompts to connect a cryptocurrency wallet due to the compromised script.

BleepingComputer verified the threat by inserting the malicious Lottie-Player JavaScript into an HTML page. Upon doing so, the script initiated a crypto drainer.

If a user attempts to connect their wallet, the script establishes a WebSocket connection to sitecastleservices01[.]com, a known entity in cryptocurrency phishing activities.

LottieFiles revealed that their JavaScript library was compromised when an authentication token from one of their developers was stolen, which was then used to upload the malicious versions of the npm package.

LottieFiles reassures that their other open-source libraries, code, GitHub repositories, and their SaaS remain unaffected. The platform is conducting an internal investigation, with assistance from external experts, to gather more insights into the incident, which will eventually be disclosed.

The exact number of affected individuals and the total cryptocurrency theft remains undetermined.

Crypto drainers are a growing issue in the cryptocurrency sector, with cybercriminals exploiting well-known accounts, compromising websites, and leveraging AI videos and malicious ads to promote sites loaded with these harmful scripts.

In 2023, both Google and Twitter ads promoted websites featuring a crypto drainer called 'MS Drainer,' resulting in a combined theft of $59 million from 63,210 victims over nine months.