OpenClaw's Theft Flow: 386 Malicious Skills and $1.2M in Crypto Stolen

The attack moved with alarming speed and scale. Security researchers identified 386 malicious skills in just three days, from February 1 to 3, 2026. This isn't a slow drip; it's a torrent of compromised code targeting the high-value crypto trading community.

The financial impact is already clear. The theft has netted over $1.2 million in stolen crypto. One attacker, operating under the handle "hightower6eu," posted skills that accumulated nearly 7,000 downloads, demonstrating the velocity at which malicious code can spread through a trusted repository.

The attack vector is precise and insidious. A malicious npm package, @openclaw-ai/openclawai, has been downloaded 178 times. It masquerades as an installer but deploys a full remote access trojan, stealing everything from crypto wallet seed phrases to SSH keys and browser data. This is a direct, high-value theft flow.

The Attack Flow: Mapping the Movement of Stolen Assets

The attack begins with a deceptive pivot. Instead of targeting the codebase directly, attackers poisoned Bing AI search results to trick users into downloading a fake OpenClaw program. This initial social engineering step is critical-it hijacks organic search traffic to a malicious landing page, bypassing traditional security layers.

Once downloaded, the malware's execution is a multi-stage flow. The core payload is the malicious npm package "@openclaw-ai/openclawai". Its postinstall hook triggers a global re-installation, making it a persistent command-line tool. The setup script then deploys a convincing fake interface, culminating in a bogus iCloud Keychain authorization prompt that captures the victim's system password. This bypasses OS protections by leveraging the user's own credentials.

All malicious components share a central nervous system. The 386 skills and the npm package are tied to the same command-and-control infrastructure at IP address 91.92.242.30. This unified C2 network indicates a coordinated, organized operation designed to exfiltrate data and maintain control over compromised systems.

Market Impact: Assessing Financial Flow and Erosion of Trust

The direct financial flow is clear: over $1.2 million in stolen crypto and the loss of user funds. This isn't just a data breach; it's a theft of actual capital from the platform's core user base. The attack's success hinged on exploiting OpenClaw's viral model, where users can add "skills" to the molthub registry to augment their assistant. This open, trust-based system became the attack vector, turning the platform's greatest strength into its biggest vulnerability.

The erosion of trust is the more insidious financial cost. When a user's AI assistant-a tool meant to automate and secure their digital life-becomes the conduit for a remote access trojan, confidence in the entire ecosystem fractures. This attack leverages a viral AI assistant's untrusted local skill installation model, amplifying supply chain risk. It's a direct parallel to the major supply-chain attack on 18 popular npm packages in September 2025, where malicious code spread through trusted dependencies. Both incidents highlight the recurring theme: rapid adoption without robust security vetting creates systemic fragility.

For OpenClaw, the operational impact is severe. The project's explosive growth was driven by its groundbreaking capabilities, but its security model was not. The fact that the creator reportedly said he had "too much to do" to address the issue after being contacted multiple times underscores a critical misalignment. The financial flow of trust, which fuels adoption and development, is now under direct assault. This attack may slow the platform's growth trajectory as users and developers reconsider the risks of integrating with a system where malicious skills can be uploaded at scale.