Cloud development platform Vercel said Sunday that attackers gained unauthorized access to parts of its internal infrastructure, an incident with potential knock-on effects for the many crypto projects that host frontends on the service.

In a security bulletin, the company said it has engaged outside incident responders and notified law enforcement. Vercel said a limited subset of customers was impacted and is being contacted directly, and that its services remain operational.

"Our investigation has revealed that the incident originated from a third-party AI tool whose Google Workspace OAuth app was the subject of a broader compromise, potentially affecting hundreds of its users across many organizations," Vercel stated. 

The disclosure followed a post on cybercrime marketplace BreachForums in which a seller going by ShinyHunters offered what they said was Vercel's internal data for $2 million, according to BleepingComputer. The poster listed access keys, source code, database records, and internal deployment credentials including NPM and GitHub tokens. The veracity of the poster's claims has not been independently verified. 

A sample shared as proof reportedly contained roughly 580 employee records, with names, company email addresses, account statuses and activity timestamps, along with a screenshot from an internal dashboard.

Attribution remains unsettled. BleepingComputer reported that members tied to the core ShinyHunters extortion group denied any role in the Vercel incident. The attacker also told the outlet they had been in contact with Vercel about the $2 million ransom, though the company has not publicly confirmed any negotiations.

Developer Theo Browne, whose coverage is widely followed in the software development community, wrote on X that his sources indicated Vercel's internal Linear and GitHub integrations were the most heavily affected systems. He added that environment variables flagged as sensitive in Vercel are protected, but those not flagged should be rotated as a precaution.

That guidance aligns with Vercel's own recommendation that customers review environment variables and use its sensitive variable feature.

Crypto's exposure

The exposure is material for crypto. Web3 teams regularly deploy wallet interfaces, DEX frontends and dapp dashboards on Vercel, and any project that stored private RPC endpoints, third-party API keys, or wallet-related secrets in plain environment variables may now need to treat those secrets as compromised.

Frontend compromises are already a recurring problem in the sector. DEX aggregator CoW Swap paused trading last week during a domain hijacking, and Aerodrome and Velodrome were both hit by a DNS hijack in November. EasyDNS just yesterday admitted culpability for the DNS hijacking of the eth.limo project. Those attacks typically work by redirecting visitors to wallet-draining clones at the registrar or DNS layer.

A compromise at the hosting and deployment layer would open a different attack surface, one that bypasses DNS monitoring entirely and could, in a worst-case scenario, allow tampering with a project's actual build output rather than just where its domain points.

It is not yet clear how the attackers breached Vercel or whether any customer-facing deployments were altered. Vercel said its investigation is ongoing and that it will update the bulletin as more information becomes available. No high-profile crypto projects have publicly admitted they were contacted by Vercel in regards to the vulnerability as of publication time.