Holdstation Wallet hacked for 462,000 USDT: Here's how hackers bypassed MFA and withdrew funds in 2 minutes

On February 26, 2026 – The Vietnam-based DeFAI Holdstation smart wallet project (built on Worldcoin and BNB Chain) confirmed it was a victim of a serious supply chain attack in the early morning of February 25, 2026. The total loss recorded is 462,000 USDT.

This is the project’s second security incident in 2026, after losing approximately $100,000 in January.

Supply Chain Attack: Not Targeting Smart Contracts but Infrastructure

According to official statements, the hacker did not directly breach user wallets or smart contracts. Holdstation and the auditing firm Verichains confirmed that the smart contracts remain secure.

Instead, the attacker targeted the application distribution infrastructure – the platform that provides updates to users.

Specifically, the hacker:

After gaining control of the infrastructure, the attacker modified the JavaScript files in the official app version, inserting malicious code as a backdoor. Users updating the app inadvertently installed the infected version.

“Silent” Withdrawal Mechanism

The malicious code is designed to activate immediately after installation:

As a result, many wallets were drained within the first few minutes after the malicious update was released.

Holdstation’s Emergency Response Within 30 Minutes

According to the timeline released (UTC+7):

Subsequently, Holdstation coordinated with Verichains to analyze on-chain data and gather evidence for the investigation.

The current confirmed total loss is 462,000 USDT.

100% Refund Commitment to Users

Holdstation commits to fully reimburse affected assets. Users are required to fill out the official form at:

https://forms.gle/9FriUzFWHx6ZPXCS7

The team will verify on-chain ownership and authenticate wallets before issuing refunds. The project emphasizes that no seed phrase, private key, or any fees are required during the reimbursement process.

Security Lessons for the Industry

The incident shows that even if smart contracts are secure, vulnerabilities in the software distribution infrastructure can cause significant losses. This type of attack is a supply chain attack – where hackers infiltrate the “entry point” of the product rather than attacking users directly.

Holdstation stated it is upgrading its entire release process, including:

This incident has attracted significant attention from the Vietnamese crypto community, as Holdstation is one of the DeFi wallet projects based in Ho Chi Minh City.

The project promises to continue updating the investigation progress in the coming days.

Vương Tiễn