Inside the StopAndProtect Operation That Hijacked 6,000+ IPs Through Compromised Websites
By Grace Davis | Decentralized Protocol PM | Security Analyst
In the sea of threats that define the modern blockchain landscape, we often assume the weakness lies in the smart contract. The code with the bug. The bridge with the exploitable signature scheme. But the attack that actually gutted thousands of cryptocurrency holders in the summer of 2024 did not touch a single line of Solidity. It started with a WordPress site, a fake CAPTCHA, and one of the most primal tricks in the hacking playbook: asking the user to do the damage to themselves.
Truth is not what is seen, but what is trusted. And the author of this campaign understood that simple human fact better than most blockchain engineers ever do. The "StopAndProtect" ransomware campaign compromised 6,000+ IPs, weaponized nearly 2,000 WordPress sites, and took something far more valuable than session cookies — the raw recovery phrases that control cryptocurrency wallets entirely.
This is not a story about smart contract exploits. This is the story of everything we believe is "user error" that is actually a highly engineered attack chain. It is the story of the Wire and the web-a silent wave that washed over ordinary players of the crypto game.
Context: The WordPress Vulnerability Engine
We don't usually think of WordPress when we talk about "crypto security." We talk about audits. About formal verification. About hardware wallets guarded by air-gapped protocols. But the decentralized ecosystem runs on a far more mundane foundation — websites, plugins, shares, and the trust between a browser window and the user behind it.
WordPress powers roughly 43% of the top websites in the world. Its plugin ecosystem is one of the most open and feature-rich in the industry, but also one of the most frequently compromised. Attackers have long understood that infiltrating these sites gives them a triple advantage: they can host malware, act as command-and-control (C2) nodes, and distribute tools — all under the legitimate coverage of a popular website. The trust we've been built to give to the big function buttons and the little padlock icons, all of it breaks down.
The phase that rolls into December, 2024, reveals a sophisticated deeper twist on this old playbook: the attackers didn't just rely on users clicking a link or enabling macros. They use a "fake CAPTCHA" prompt — the same visual we all naturally trust ("I'm not a robot") — and turned what was initially a human-verification moment into a machine-execution of a PowerShell command.
We assume that a window in the browser is just an entry point. In this attack, It was the exit door.
Core Insights: An End-to-End Attack Chain
The VICTIM LOOP: Fake CAPTCHA Leads to Real Wallet Drain
The attack cycle flows as smooth as a supply chain built by a high-performance logistics company:
1. The WordPress Infection: Attackers compromise WordPress websites either through known plugin vulnerabilities or brute-force attacks. 2. The Script Injection: On these sites, a JavaScript snippet is injected. When a visitor navigates to the homepage or some damaging pages, the script loads a legitimate-looking "completion/verification dialog" in the browser, usually showing an anti-bot component (CAPTCHA). 3. The PowerShell Secret: If a user presses "I'm not a human," a prompt will open — often what appears to be a legal "run" command — instructing them to paste the code into a PowerShell window or run a specific script. 4. The Execution: The PowerShell command runs a malicious script that: - Steals credentials: From browsers and system. - Extracts the recovery phrase: It scans files, browsers, and metadata for 12 or 24-word BIP-39 seed phrases. - Screenshots: Takes okay screenshots to capture user activity and potential transcription of ideas. 5. Propagation: The malware propagates across the local network and infects USB devices, widening the campaign from one compromised computer to whole office/abuse network. 6. Ransomware Deployment: Once the threat has been harvested, the StopAndProtect ransomware locks the compromised systems — demanding a ransom for the unlock.
The Scale: 6,000+ Wires and 31,000+ Screenshots
According to forensic analysis, the infection impacted more than 6,000 distinct IP addresses between mid-May and late July. Behind this network, the jump infrastructure operated through 1,750+ compromised WordPress sites, which served as both the delivery and the permanent hosting and storage for the stolen files.
The big captures: 31,000+ screenshots, 700+ archive files with exfiltrated data — the attacker's “data vault” showing a pattern of patience. They're not going for a quick cashout; they're harvesting widely and methodically, and they're planning to use the recovery phrases found in this hard-coded way for both current TODO and the future.
The Methodology We Usually Don't Talk About
We often teach: "Don't access answers from non-official app." But our ephemeral PSA did not touch the mass-market ETH pickup. What is really vulnerable here is the backend of the binary user's execution chain.
Microsoft supported PowerShell — an extremely powerful scripting language that can execute code with the current user's credentials. We don't build an AI that "knows better" — an alert with a dialing popup — that emerges from the "Run after the copy, you're safe"?
One could argue: "Go use a hardware wallet" or "Don't store the phase on the device." And that works — for a minority of experienced users. But what about:
- The grandma who used a hot wallet on a bridge to mint an NFT?
- The traffic exchange that uses PayPal?
- The new trader who opens its 24-word phase in an email?
This is an attack designed at the base layer of enthusiastic humanity, and it does not depend on a bug in the blockchain. It depends on the trust layer — the Windows machine, the local network device, the “internet habit”.
Beyond the CAPTCHA evasion, StopAndProtect exposes a far more subtle — and worrying — vulnerability: the wallet recovery phrase isn't just a number in a secret. It's a plain-text password.
Contrarian Angle: The Discourse About "Personal Error" Is Because Companies Failed
Here is a fact that many won't repeat enough: The crypto industry spends billions auditing contracts, but almost nothing on end-user security education. DEXs advertise "non-custodiality" like a feature — but the non-custodial responsibility falls entirely on the user's own device and habits.
This attack reveals the ugly symptom of that design.
On the platform level, there is no such thing as "personal protection" — because the default security heat return, in the form of American security programs, is still closed unit. The Hard-line "Don't put excuses to the market" message is as if it was clearly pushed against the wall. And a chain of platform risks, placed on a single user.
The dangerous assumption is privacy equals sovereignty. But, in the era of a forged CAPTCHA, "sovereignty" becomes a slap in the face if we can't protect the storage itself.
From the architecture side: maybe we need to think whether a standard web browser should be a safe container for "using dApps at all". Or whether we need a strong hardware-based secure compartment at the browser level. Trusted computing, phishing-resistant anti-cheat reusing, secure keys held in TPM — these are things we carefully add to enterprises, but not to a retail user.
Is the financial ecosystem of 100 billion USD honestly decided upon a command line in a Windows validator?
Chrome extension, endpoint marketing, their limitations
We usually advise "install uBlock Origin" and "enable Multi-Factor Authentication". They are good punctual-pieces, but the attack proves that:
- Sitting on a browser will not protect you from a script that demands "run".
- Running an MFA default, does it save? When the attacker has the Seeds, they have "the marriage, the missing version, the MAC, and the scam" — no authentication step will resist a valid, authorized machine.
The phishing alarm in the default session doesn't protect from the most obvious sign: a website instructing to paste a code. A screaming alert from your antivirus would, though, during that exact prompt — 1 in 3 professional user UI knows that.
Whats more — this could be the first phase of a trend: they repeated same attack into mobile platforms failed at the when? (confidentiality, "MAC goes chaintop, verified by our exclusive" — i used this scam mask make pwoer transmission almost invisible). The same SQL might get obsolete, but the easiest slip — "we need new updates" — is now a new tool.
Words we still don't say
The hunters and the shotgun when
We need deeper isolation at the operating system level:
- modern Windows/OS-level "isolation" of scenes (plus explicitly signed execution).
- Advanced Virtualization (e.g., Intel VT-x, formalization hypervisor) — make easily invisible steps, next control.
- hardened browser upgrades — where script, validation, and popup interactions meet in a sandboxed, formalized surface.
- Amplif a separate, hardware-level "seed-phrase-in" canvas: no web browser should ever load the data onto the physical copy of the vault — unless the vault cryptographically requires it.
Blockship, when built as the company's hunch foundation, it is not unreasonable to care about the "human-in-the-terminal."
The concept of "self-custody" is impossible to get when surrounded by capture. If the seed-phrase is typed, thought, or automated—the state is out. We are all absolutely in need of the positive — a global OS-level, hardware-anchored offline secret manager, that works for every user without exception.
It feels like the rhythm old. But until the day, the seed phrase will remain the ultimate attack surface. It's not malicious networks that are the forcing function. It's the failure of requirement interfaces to match the user's mental security model.
Opportunity in the Backdrop
But honestly, — we want to see more development here. Stricter rules for OS-level security. Tougher road-Sec for application providers (probably with the back-end sandbox). A serious partnership of WordPress (now Web, actually) with the signing contest. Web3 joss "web certificate" should be a common-case norm for an era which expects cryptocurrency distributing autoprime gems.
The simple win to this editorial: raise the floor — build measurement and unforgeable domain governing 0 header rules. Do not let a full 3000-site robot serve the DOC, weighted protocol.
This is the guidance for Web3 — our love and fear of centralization — and the "public property of the code" truth: we let the safest point of our current web surface get replaced by a message behavior that "the fundamental transport" beingASCII-safe.
Takeaway
We assume our decentralized wallet is a fortress outside a fortress. But frontlinely it's not separate; it's the prior in the house of the grid— with the deepest trust in the grid.
This summer's event is not just "another security anecdote." It's a state: extended ecosystems will target the weak human bridge we left alone: the "home screen", the "default_ps1 runtime", the "my_wallet_recovery.txt".
So the next time your wallet suggests you "control by export-the-seed-as-image" — or your robot says "answer the CAPTCHA, so I can scan your keydown" — remember: cryptography can secure the inability perfectly. But the encryptor's chlorine is always.
Truth is not what is seen, but what is trusted — and the deck is stack against the trust of a human sittingly.
