Hackers bought 30 WordPress plugins and planted backdoors, laying low for 8 months, using Ethereum smart contracts to bypass domain blocking
In August 2025, a buyer calling himself “Kris” planted a timed bomb in 191 lines of code; eight months later it detonated, and C2 communications bypassed the blocklist. This article is based on a report by security researcher Austin Ginder.
(Previously: BTC surges to $75,000! ETH rebounds to 2400; Vance says the U.S.-Iran negotiations have “made a lot of progress,” with a tentative second round of talks on the 16th)
(Background: Gate founder Dr. Han’s 13th-anniversary open letter: during a cycle transition, unleash the power of change)
Table of Contents
Toggle
191 lines, a single “compatibility update”
wp-config.php is written with 6KB of malicious code
This isn’t the first time, and it won’t be the last
A system issue, not a technical one