Hackers compromised the GitHub account of a developer from the Injective project and released a malicious npm package designed to steal private keys and seed phrases directly from wallet creation functions. 🔑 This package received approximately 50,000 downloads per week, and the malicious version was linked to 17 other packages. ⏱️ The malicious code remained on the system for less than one hour but was already downloaded over 300 times. 🕵️ The most insidious aspect: stolen keys were exfiltrated through a domain impersonating Injective’s official server, making the traffic appear legitimate to detection systems. 💸 CertiK reported that wallet compromise was the most profitable attack vector in the first half of 2026, resulting in $444 million in losses across just 33 incidents—an average of over $13 million per attack. The blockchain itself was not hacked; the keys were stolen the moment they were generated. In this scenario, is crypto security in 2026 vulnerable because of on-chain code—or the humans who wrote it?