{"id":2381,"date":"2026-05-26T11:24:48","date_gmt":"2026-05-26T11:24:48","guid":{"rendered":"https:\/\/tokenmetrics.com\/blog\/trapdoor-malware-campaign-crypto-developers\/"},"modified":"2026-07-06T07:30:58","modified_gmt":"2026-07-06T07:30:58","slug":"trapdoor-malware-campaign-crypto-developers","status":"publish","type":"post","link":"https:\/\/tokenmetrics.com\/apt\/news\/trapdoor-malware-campaign-crypto-developers\/","title":{"rendered":"TrapDoor Malware Hits Crypto Devs \u2014 Token Metrics Technicals Read Bullish on APT"},"content":{"rendered":"<p><!-- TM_CHART_MOBILE_WIDTH_HOTFIX_START --><\/p>\n<style id=\"tm-chart-mobile-width-hotfix\">\n.single .entry-content > .tm-tv-chart {\n  box-sizing: border-box !important;\n  width: min(var(--cs-entry-content-large-width, 598px), calc(100vw - 3rem)) !important;\n  max-width: calc(100vw - 3rem) !important;\n  margin-left: calc(min(var(--cs-entry-content-large-width, 598px), calc(100vw - 3rem)) \/ -2 + 50%) !important;\n  margin-right: calc(min(var(--cs-entry-content-large-width, 598px), calc(100vw - 3rem)) \/ -2 + 50%) !important;\n  overflow: hidden !important;\n}\n.tm-tv-chart__canvas { width: 100% !important; min-height: 190px !important; }\n.tm-tv-chart__canvas > svg.tm-tv-chart__svg { display:block; width:100% !important; height:100% !important; }\n.tm-tv-chart__canvas .tv-lightweight-charts { display:none !important; }\n@media (max-width: 575px) {\n  .single .entry-content > .tm-tv-chart {\n    width: 100% !important;\n    max-width: 100% !important;\n    margin-left: 0 !important;\n    margin-right: 0 !important;\n    padding: 0.9rem 0.8rem 0.7rem !important;\n  }\n  .single .entry-content > .tm-tv-chart .tm-tv-chart__caption {\n    text-align: left !important;\n    font-size: 0.76em !important;\n    line-height: 1.35 !important;\n  }\n}\n<\/style>\n<p><script id=\"tm-chart-svg-width-hotfix\">\n(function(){\n  var BRAND={bg:'#17171D',line:'#FFD60A',grid:'rgba(232,234,242,.10)',text:'rgba(232,234,242,.70)'};\n  function esc(s){return String(s).replace(\/[&<>\\\"]\/g,function(c){return {'&':'&amp;','<':'&lt;','>':'&gt;','\"':'&quot;'}[c];});}\n  function fmtTick(v){if(Math.abs(v)>=1000){return '$'+Math.round(v\/1000).toLocaleString('en-US')+'K';} return '$'+Math.round(v).toLocaleString('en-US');}\n  function fmtPrice(v){return '$'+v.toLocaleString('en-US',{minimumFractionDigits:2,maximumFractionDigits:2});}\n  function fmtDate(ts){return new Date(ts*1000).toLocaleDateString(undefined,{month:'short',day:'numeric',timeZone:'UTC'});}\n  function draw(fig,data){\n    if(!data||data.length<2) return;\n    var canvas=fig.querySelector('.tm-tv-chart__canvas'); if(!canvas) return;\n    var compact=canvas.getBoundingClientRect&#038;&#038;canvas.getBoundingClientRect().width<420;\n    var h=compact?200:(parseInt(fig.getAttribute('data-tm-chart-height')||'220',10)||220);\n    canvas.style.height=h+'px';\n    var w=1000,pad=compact?{l:18,r:132,t:14,b:32}:{l:20,r:96,t:14,b:34},plotW=w-pad.l-pad.r,plotH=h-pad.t-pad.b;\n    var vals=data.map(function(d){return d.value;}),rawMin=Math.min.apply(null,vals),rawMax=Math.max.apply(null,vals),rawSpan=Math.max(rawMax-rawMin,Math.abs(rawMax)*.01,1); function niceStep(range,targetTicks){var rough=range\/Math.max(1,targetTicks-1),exponent=Math.pow(10,Math.floor(Math.log10(rough))),fraction=rough\/exponent,niceFraction=fraction<=1?1:fraction<=2?2:fraction<=5?5:10; return niceFraction*exponent;} var step=niceStep(rawSpan*1.16,6),min=Math.floor((rawMin-rawSpan*.12)\/step)*step,max=Math.ceil((rawMax+rawSpan*.12)\/step)*step,span=Math.max(max-min,step);\n    function x(i){return pad.l+(data.length===1?plotW:(i\/(data.length-1))*plotW);} function y(v){return pad.t+((max-v)\/span)*plotH;}\n    var line=data.map(function(d,i){return (i?'L':'M')+x(i).toFixed(1)+' '+y(d.value).toFixed(1);}).join(' ');\n    var area=line+' L'+x(data.length-1).toFixed(1)+' '+(pad.t+plotH).toFixed(1)+' L'+pad.l+' '+(pad.t+plotH).toFixed(1)+' Z';\n    var grid=''; for(var gv=max;gv>=min-step*.5;gv-=step){var gy=y(gv); grid+='<line x1=\"'+pad.l+'\" y1=\"'+gy.toFixed(1)+'\" x2=\"'+(pad.l+plotW)+'\" y2=\"'+gy.toFixed(1)+'\" stroke=\"'+BRAND.grid+'\"\/>'; grid+='<text x=\"'+(pad.l+plotW+10)+'\" y=\"'+(gy+4).toFixed(1)+'\" fill=\"'+BRAND.text+'\" font-size=\"20\">'+esc(fmtTick(gv))+'<\/text>';}\n    var labels=''; [0,Math.floor((data.length-1)\/2),data.length-1].forEach(function(idx,n){labels+='<text x=\"'+x(idx).toFixed(1)+'\" y=\"'+(h-9)+'\" text-anchor=\"'+(n===0?'start':n===2?'end':'middle')+'\" fill=\"rgba(232,234,242,.62)\" font-size=\"'+(compact?24:20)+'\">'+esc(fmtDate(data[idx].time))+'<\/text>';});\n    canvas.innerHTML='<svg class=\"tm-tv-chart__svg\" viewBox=\"0 0 '+w+' '+h+'\" width=\"100%\" height=\"100%\" preserveAspectRatio=\"none\" role=\"presentation\" aria-hidden=\"true\"><rect x=\"0\" y=\"0\" width=\"'+w+'\" height=\"'+h+'\" fill=\"'+BRAND.bg+'\"\/>'+grid+'<path d=\"'+area+'\" fill=\"rgba(255,214,10,.18)\"\/><path d=\"'+line+'\" fill=\"none\" stroke=\"'+BRAND.line+'\" stroke-width=\"5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/>'+labels+'<\/svg>';\n    var price=fig.querySelector('[data-tm-chart-price]'), ch=fig.querySelector('[data-tm-chart-change]'), last=data[data.length-1], base=data[0];\n    if(price) price.textContent=fmtPrice(last.value); if(ch){var abs=last.value-base.value,pct=base.value?(abs\/base.value)*100:0; ch.textContent=(abs>=0?'+':'\u2212')+'$'+Math.abs(abs).toLocaleString('en-US',{maximumFractionDigits:2})+' ('+(pct>=0?'+':'\u2212')+Math.abs(pct).toFixed(2)+'%)';}\n  }\n  function render(fig){ if(fig.dataset.tmSvgHotfixReady) return; var id=fig.getAttribute('data-tm-chart-id'), days=fig.getAttribute('data-tm-chart-days')||'14'; if(!id) return; fig.dataset.tmSvgHotfixReady='1'; fetch('https:\/\/api.coingecko.com\/api\/v3\/coins\/'+encodeURIComponent(id)+'\/ohlc?vs_currency=usd&days='+encodeURIComponent(days),{credentials:'omit'}).then(function(r){return r.ok?r.json():[];}).then(function(rows){var data=(Array.isArray(rows)?rows:[]).map(function(k){return {time:Math.floor(k[0]\/1000),value:parseFloat(k[4])};}).filter(function(d){return isFinite(d.value);}); draw(fig,data); if(window.ResizeObserver){new ResizeObserver(function(){draw(fig,data);}).observe(fig.querySelector('.tm-tv-chart__canvas'));}}).catch(function(){}); }\n  function run(){document.querySelectorAll('[data-tm-chart]').forEach(render);} if(document.readyState==='loading') document.addEventListener('DOMContentLoaded',run); else run(); setTimeout(function(){document.querySelectorAll('[data-tm-chart]').forEach(function(f){delete f.dataset.tmSvgHotfixReady; render(f);});},1800);\n})();\n<\/script><br \/>\n<!-- TM_CHART_MOBILE_WIDTH_HOTFIX_END --><\/p>\n<h2>TL;DR<\/h2>\n<p>Token Metrics technicals on APT read bullish as TrapDoor malware targets crypto developers. Socket Security flagged an active supply-chain attack that deployed more than 34 malicious packages across npm, PyPI, and Crates.io. The campaign specifically targets developers working with Aptos, Sui, and Solana, stealing wallet keystores, SSH keys, and cloud credentials. APT is trading near $0.99 and up about 3% on the day.<\/p>\n<h2>Context<\/h2>\n<p>Crypto developers are prime targets for supply-chain attacks. Their machines hold the keys to everything: wallet funds, cloud infrastructure, and Git repositories. The TrapDoor campaign is the latest threat in this area. Socket Security researchers found the attack on Sunday. They spotted malicious packages made to blend into normal developer work.<\/p>\n<p>The attack uses standard package features to run bad code. This raises no red flags. Postinstall hooks in npm packages, Python import triggers in PyPI packages. Rust build.rs scripts in Crates.io packages all run during normal software installs. Developers can get infected just by adding what looks like a real dependency to their project.<\/p>\n<p>The first bad package found was eth-security-auditor@0.1.0 on PyPI. It was uploaded on May 22 at 20:20 UTC. More bad releases followed across all three package registries through the weekend. Socket caught these packages fast. The median detection time was 5 minutes and 27 seconds after publication. This stopped the spread.<\/p>\n<p>The data theft targets are comprehensive. The malware looks for SSH keys, wallet keystores for Sui, Solana and Aptos, AWS credentials. GitHub tokens, browser data, crypto wallet extension files, environment variables. API keys. It targets data from Coinbase, Binance, MetaMask, and Brave wallets. The companies themselves were not hacked.<\/p>\n<p>The technical skill varies by platform. The npm version has a 1,149-line JavaScript file called trap-core.js. It uses Fernet and ECDH encryption. It checks stolen AWS and GitHub credentials through live API calls. This helps find high-value targets. Crates.io packages use simple XOR encryption with the key cargo-build-helper-2026. They send data to GitHub Gists.<\/p>\n<p>The malware stays active through systemd services, cron jobs, Git hooks, and shell hooks. A smart feature targets AI coding assistants. It changes .cursorrules and CLAUDE.md files. It hijacks the same hooks developers use for tools like Cursor and Claude Code.<\/p>\n<p>Security firm SlowMist issued warning SM-2026-352284. They compared TrapDoor to the npm worm Mini Shai-Hulud. All bad packages were reported to the registries for removal. The attacker&#8217;s GitHub page has a document. It calls the operation a Universal AI Agent Extraction Framework. The attacker might use AI to improve the malware.<\/p>\n\t\t<style id=\"tm-token-card-styles\">\n\t\t.tm-token-card {\n\t\t\tposition: relative;\n\t\t\tmargin: 1.75em 0;\n\t\t\tpadding: 1.25em 1.4em 1.4em;\n\t\t\tbackground: #17171D;\n\t\t\tborder: 1px solid rgba(255, 214, 10, 0.18);\n\t\t\tborder-radius: 16px;\n\t\t\tcolor: #e8eaf2;\n\t\t\tfont-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, \"Helvetica Neue\", Arial, sans-serif;\n\t\t\toverflow: hidden;\n\t\t}\n\t\t.tm-token-card::before {\n\t\t\tcontent: \"\";\n\t\t\tposition: absolute;\n\t\t\ttop: 0;\n\t\t\tleft: 0;\n\t\t\twidth: 4px;\n\t\t\theight: 100%;\n\t\t\tbackground: #FFD60A;\n\t\t}\n\t\t.tm-token-card__header {\n\t\t\tdisplay: flex;\n\t\t\tflex-direction: column;\n\t\t\tgap: 0.4em;\n\t\t\tmargin-bottom: 1em;\n\t\t}\n\t\t.tm-token-card__eyebrow {\n\t\t\tmargin: 0;\n\t\t\tfont-size: 0.72em;\n\t\t\tfont-weight: 700;\n\t\t\tletter-spacing: 0.12em;\n\t\t\ttext-transform: uppercase;\n\t\t\tcolor: #FFD60A;\n\t\t}\n\t\t.tm-token-card__title {\n\t\t\tmargin: 0;\n\t\t\tdisplay: inline-flex;\n\t\t\talign-items: baseline;\n\t\t\tgap: 0.55em;\n\t\t\tflex-wrap: wrap;\n\t\t\tfont-size: 1.5em;\n\t\t\tfont-weight: 700;\n\t\t\tline-height: 1.15;\n\t\t\tcolor: #ffffff;\n\t\t\tletter-spacing: -0.01em;\n\t\t}\n\t\t.tm-token-card__name {\n\t\t\tcolor: #ffffff;\n\t\t}\n\t\t.tm-token-card__ticker {\n\t\t\tpadding: 0.2em 0.6em;\n\t\t\tbackground: rgba(255, 214, 10, 0.14);\n\t\t\tcolor: #FFD60A;\n\t\t\tfont-size: 0.55em;\n\t\t\tfont-weight: 700;\n\t\t\tletter-spacing: 0.08em;\n\t\t\tborder-radius: 999px;\n\t\t\ttext-transform: uppercase;\n\t\t\tline-height: 1;\n\t\t}\n\t\t\/* Recap theme forces `list-style-type: disc` on .entry-content ul\n\t\t * and `padding-left: 0` on every <li> via a high-specificity\n\t\t * selector chain (style.css:1872+). We need !important on these\n\t\t * specific properties to (a) suppress the native bullet so it\n\t\t * doesn't double up with our check icon, and (b) keep enough\n\t\t * left padding on the <li> to make room for the absolutely\n\t\t * positioned check icon without text overlap. *\/\n\t\t.tm-token-card__benefits {\n\t\t\tlist-style: none !important;\n\t\t\tmargin: 0 0 1.25em;\n\t\t\tpadding: 0 !important;\n\t\t\tdisplay: flex;\n\t\t\tflex-direction: column;\n\t\t\tgap: 0.55em;\n\t\t}\n\t\t.tm-token-card__benefit {\n\t\t\tposition: relative;\n\t\t\tpadding-left: 2.25em !important;\n\t\t\tpadding-right: 0;\n\t\t\tmargin: 0;\n\t\t\tfont-size: 0.95em;\n\t\t\tline-height: 1.5;\n\t\t\tcolor: rgba(232, 234, 242, 0.9);\n\t\t}\n\t\t.tm-token-card__benefit::marker {\n\t\t\tcontent: \"\" !important;\n\t\t}\n\t\t.tm-token-card__benefit::before {\n\t\t\tcontent: \"\";\n\t\t\tposition: absolute;\n\t\t\tleft: 0;\n\t\t\ttop: 0.32em;\n\t\t\twidth: 1.2em;\n\t\t\theight: 1.2em;\n\t\t\tbackground-image: url(\"data:image\/svg+xml;utf8,<svg xmlns='http:\/\/www.w3.org\/2000\/svg' viewBox='0 0 16 16' fill='none'><circle cx='8' cy='8' r='7.5' fill='%23FFD60A'\/><path d='M4.5 8.2l2.3 2.3L11.5 5.8' stroke='%2317171D' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'\/><\/svg>\");\n\t\t\tbackground-repeat: no-repeat;\n\t\t\tbackground-size: contain;\n\t\t\tbackground-position: center;\n\t\t}\n\t\t.tm-token-card__footer {\n\t\t\tdisplay: flex;\n\t\t\talign-items: center;\n\t\t\tgap: 1em;\n\t\t\tflex-wrap: wrap;\n\t\t}\n\t\t.tm-token-card__cta {\n\t\t\tdisplay: inline-flex;\n\t\t\talign-items: center;\n\t\t\tpadding: 0.85em 1.4em;\n\t\t\tbackground: #FFD60A;\n\t\t\tcolor: #0a0e14;\n\t\t\tfont-weight: 800;\n\t\t\tfont-size: 0.95em;\n\t\t\tline-height: 1;\n\t\t\ttext-decoration: none;\n\t\t\tborder-radius: 999px;\n\t\t\twhite-space: nowrap;\n\t\t\ttransition: transform 0.15s ease, background 0.15s ease, box-shadow 0.15s ease;\n\t\t}\n\t\t.tm-token-card__cta:visited {\n\t\t\tcolor: #0a0e14;\n\t\t}\n\t\t.tm-token-card__cta:hover,\n\t\t.tm-token-card__cta:focus {\n\t\t\tbackground: #ffe04b;\n\t\t\tcolor: #0a0e14;\n\t\t\ttransform: translateY(-1px);\n\t\t\ttext-decoration: none;\n\t\t\tbox-shadow: 0 6px 20px rgba(255, 214, 10, 0.28);\n\t\t}\n\t\t.tm-token-card__meta {\n\t\t\tfont-size: 0.8em;\n\t\t\tcolor: rgba(232, 234, 242, 0.55);\n\t\t\tletter-spacing: 0.01em;\n\t\t}\n\t\t\/* Lightweight Charts price chart \u2014 TM yellow on core dark, CoinGecko OHLC *\/\n\t\t.tm-tv-chart {\n\t\t\tbox-sizing: border-box;\n\t\t\tmargin: 1.5em 0;\n\t\t\tpadding: 1em 1em 0.75em;\n\t\t\tbackground: #17171D;\n\t\t\tborder: 1px solid rgba(255, 214, 10, 0.18);\n\t\t\tborder-radius: 16px;\n\t\t\tcolor: #e8eaf2;\n\t\t\tfont-family: inherit;\n\t\t\tfont-size: inherit;\n\t\t\tline-height: 1.5;\n\t\t\toverflow: hidden;\n\t\t}\n\t\t.single .entry-content > .tm-tv-chart {\n\t\t\twidth: min(var(--cs-entry-content-large-width, 598px), calc(100vw - 3rem));\n\t\t\tmax-width: calc(100vw - 3rem);\n\t\t\tmargin-left: calc(min(var(--cs-entry-content-large-width, 598px), calc(100vw - 3rem)) \/ -2 + 50%);\n\t\t\tmargin-right: calc(min(var(--cs-entry-content-large-width, 598px), calc(100vw - 3rem)) \/ -2 + 50%);\n\t\t}\n\t\t@media (max-width: 575px) {\n\t\t\t.single .entry-content > .tm-tv-chart {\n\t\t\t\twidth: 100%;\n\t\t\t\tmax-width: 100%;\n\t\t\t\tmargin-left: 0;\n\t\t\t\tmargin-right: 0;\n\t\t\t\tpadding: 1rem 0.85rem 0.75rem;\n\t\t\t}\n\t\t\t.tm-tv-chart__caption {\n\t\t\t\ttext-align: left;\n\t\t\t}\n\t\t}\n\t\t.tm-tv-chart__header {\n\t\t\tdisplay: flex;\n\t\t\talign-items: baseline;\n\t\t\tjustify-content: space-between;\n\t\t\tgap: 0.75em;\n\t\t\tmargin: 0 0.25em 0.6em;\n\t\t\tflex-wrap: wrap;\n\t\t}\n\t\t.tm-tv-chart__title {\n\t\t\tdisplay: inline-flex;\n\t\t\talign-items: baseline;\n\t\t\tgap: 0.5em;\n\t\t\tmin-width: 0;\n\t\t}\n\t\t.tm-tv-chart__name {\n\t\t\tfont-size: 1.125em;\n\t\t\tfont-weight: 700;\n\t\t\tcolor: #e8eaf2;\n\t\t\tletter-spacing: 0.01em;\n\t\t}\n\t\t.tm-tv-chart__ticker {\n\t\t\tpadding: 0.15em 0.55em;\n\t\t\tbackground: rgba(255, 214, 10, 0.14);\n\t\t\tcolor: #FFD60A;\n\t\t\tfont-size: 0.7em;\n\t\t\tfont-weight: 700;\n\t\t\tletter-spacing: 0.06em;\n\t\t\tborder-radius: 999px;\n\t\t\ttext-transform: uppercase;\n\t\t}\n\t\t.tm-tv-chart__quote {\n\t\t\tdisplay: inline-flex;\n\t\t\talign-items: baseline;\n\t\t\tgap: 0.5em;\n\t\t}\n\t\t.tm-tv-chart__price {\n\t\t\tfont-size: 1.25em;\n\t\t\tfont-weight: 700;\n\t\t\tcolor: #e8eaf2;\n\t\t\tfont-variant-numeric: tabular-nums;\n\t\t}\n\t\t.tm-tv-chart__change {\n\t\t\tfont-size: 0.95em;\n\t\t\tfont-weight: 600;\n\t\t\tcolor: rgba(232, 234, 242, 0.55);\n\t\t\tfont-variant-numeric: tabular-nums;\n\t\t}\n\t\t.tm-tv-chart__change--up   { color: #4ade80; }\n\t\t.tm-tv-chart__change--down { color: #f87171; }\n\t\t.tm-tv-chart__canvas {\n\t\t\twidth: 100%;\n\t\t\tmin-height: 120px;\n\t\t}\n\t\t.tm-tv-chart__caption {\n\t\t\tmargin: 0.4em 0.25em 0;\n\t\t\tfont-size: 0.8em;\n\t\t\tcolor: rgba(232, 234, 242, 0.45);\n\t\t\ttext-align: right;\n\t\t}\n\n\t\t\/* Token stats panel \u2014 chart + stats + CTA stack on news posts *\/\n\t\t.tm-token-stats {\n\t\t\tmargin: 1.5em 0;\n\t\t\tpadding: 1em 1.1em 0.85em;\n\t\t\tbackground: #17171D;\n\t\t\tborder: 1px solid rgba(255, 214, 10, 0.18);\n\t\t\tborder-radius: 16px;\n\t\t\tcolor: #e8eaf2;\n\t\t\tfont-family: inherit;\n\t\t\tfont-size: inherit;\n\t\t\tline-height: 1.5;\n\t\t}\n\t\t.tm-token-stats__header {\n\t\t\tdisplay: flex; align-items: baseline; justify-content: space-between;\n\t\t\tgap: 0.75em; margin-bottom: 0.6em;\n\t\t}\n\t\t.tm-token-stats__title {\n\t\t\tmargin: 0; font-size: 0.9em; font-weight: 700; color: #FFD60A;\n\t\t\tletter-spacing: 0.04em; text-transform: uppercase;\n\t\t}\n\t\t.tm-token-stats__lookback {\n\t\t\tfont-size: 0.7em; color: rgba(232, 234, 242, 0.5);\n\t\t\ttext-transform: uppercase; letter-spacing: 0.06em;\n\t\t}\n\t\t.tm-token-stats__section { margin-bottom: 0.6em; }\n\t\t.tm-token-stats__section:last-child { margin-bottom: 0; }\n\t\t.tm-token-stats__section-label {\n\t\t\tmargin: 0 0 0.25em; font-size: 0.7em; font-weight: 700;\n\t\t\tletter-spacing: 0.12em; text-transform: uppercase;\n\t\t\tcolor: rgba(255, 214, 10, 0.65);\n\t\t}\n\t\t.tm-token-stats__grid {\n\t\t\tdisplay: grid; grid-template-columns: repeat(3, minmax(0, 1fr));\n\t\t\tgap: 0.25em 0.75em; margin: 0; padding-top: 0.25em;\n\t\t\tborder-top: 1px solid rgba(232, 234, 242, 0.06);\n\t\t}\n\t\t.tm-token-stats__cell {\n\t\t\tdisplay: flex; flex-direction: column; gap: 0.15em; min-width: 0; padding: 0.3em 0;\n\t\t}\n\t\t.tm-token-stats__cell dt {\n\t\t\tmargin: 0; font-size: 0.8em; color: rgba(232, 234, 242, 0.55);\n\t\t\tfont-weight: 500; letter-spacing: 0.02em;\n\t\t}\n\t\t.tm-token-stats__cell dd {\n\t\t\tmargin: 0; font-size: 1em; font-weight: 700; color: #e8eaf2;\n\t\t\tfont-variant-numeric: tabular-nums; line-height: 1.3;\n\t\t}\n\t\t.tm-token-stats__cell dd[data-trend=\"up\"]   { color: #4ade80; }\n\t\t.tm-token-stats__cell dd[data-trend=\"down\"] { color: #f87171; }\n\t\t.tm-token-stats__range {\n\t\t\tdisplay: flex; flex-direction: column; gap: 3px; width: 100%; min-width: 0;\n\t\t}\n\t\t.tm-token-stats__range-track {\n\t\t\tposition: relative; width: 100%; height: 0.2em; margin-top: 0.35em;\n\t\t\tbackground: rgba(232, 234, 242, 0.12); border-radius: 999px;\n\t\t}\n\t\t.tm-token-stats__range-dot {\n\t\t\tposition: absolute; top: 50%; width: 0.6em; height: 0.6em;\n\t\t\tmargin-top: -0.3em; margin-left: -0.3em;\n\t\t\tbackground: #FFD60A; border-radius: 50%;\n\t\t\tbox-shadow: 0 0 0 0.15em rgba(23, 23, 29, 1);\n\t\t}\n\t\t.tm-token-stats__range-bounds {\n\t\t\tdisplay: flex; justify-content: space-between; width: 100%;\n\t\t\tfont-size: 0.75em; font-weight: 500; line-height: 1.2;\n\t\t\tcolor: rgba(232, 234, 242, 0.55); font-variant-numeric: tabular-nums;\n\t\t}\n\t\t.tm-token-stats__source {\n\t\t\tmargin: 0.75em 0 0; font-size: 0.75em; color: rgba(232, 234, 242, 0.45); text-align: right;\n\t\t}\n\t\t@media (max-width: 560px) {\n\t\t\t.tm-token-stats__grid { grid-template-columns: repeat(2, minmax(0, 1fr)); }\n\t\t}\n\t\t@media (max-width: 640px) {\n\t\t\t.tm-token-card {\n\t\t\t\tgrid-template-columns: auto 1fr;\n\t\t\t\tgrid-template-rows: auto auto;\n\t\t\t\tgap: 8px 14px;\n\t\t\t}\n\t\t\t.tm-token-card__cta {\n\t\t\t\tgrid-column: 1 \/ -1;\n\t\t\t\tjustify-content: center;\n\t\t\t}\n\t\t}\n\t<\/style>\n\t\t<figure\n\t\tclass=\"tm-tv-chart\"\n\t\tdata-tm-chart\n\t\tdata-tm-chart-id=\"aptos\"\n\t\tdata-tm-chart-days=\"14\"\n\t\tdata-tm-chart-height=\"220\"\n\t>\n\t\t<header class=\"tm-tv-chart__header\">\n\t\t\t<div class=\"tm-tv-chart__title\">\n\t\t\t\t<span class=\"tm-tv-chart__name\">Aptos<\/span>\n\t\t\t\t<span class=\"tm-tv-chart__ticker\">APT<\/span>\n\t\t\t<\/div>\n\t\t\t<div class=\"tm-tv-chart__quote\">\n\t\t\t\t<span class=\"tm-tv-chart__price\" data-tm-chart-price>\u2014<\/span>\n\t\t\t\t<span class=\"tm-tv-chart__change\" data-tm-chart-change><\/span>\n\t\t\t<\/div>\n\t\t<\/header>\n\t\t<div\n\t\t\tclass=\"tm-tv-chart__canvas\"\n\t\t\trole=\"img\"\n\t\t\taria-label=\"Price chart for Aptos\"\n\t\t\tstyle=\"height: 220px;\"\n\t\t><\/div>\n\t\t<figcaption class=\"tm-tv-chart__caption\">Live price for Aptos \u2014 data via CoinGecko.<\/figcaption>\n\t<\/figure>\n\t\t<script id=\"tm-tv-chart-hydrator\">\n\t(function () {\n\t\tvar TM_BRAND = {\n\t\t\tbg:      '#17171D',\n\t\t\tline:    '#FFD60A',\n\t\t\tfillTop: 'rgba(255, 214, 10, 0.40)',\n\t\t\tfillBot: 'rgba(255, 214, 10, 0.00)',\n\t\t\ttext:    '#e8eaf2',\n\t\t\tgrid:    'rgba(232, 234, 242, 0.06)',\n\t\t\tborder:  'rgba(255, 214, 10, 0.18)'\n\t\t};\n\t\tfunction loadLibrary(cb) {\n\t\t\tif (window.LightweightCharts) { cb(); return; }\n\t\t\tvar s = document.createElement('script');\n\t\t\ts.src = 'https:\/\/unpkg.com\/lightweight-charts@4.2.3\/dist\/lightweight-charts.standalone.production.js';\n\t\t\t\/\/ Subresource Integrity hash for the pinned 4.2.3 build.\n\t\t\t\/\/ Greptile P1 (PR #1470): without SRI, a compromised npm\n\t\t\t\/\/ package or a CDN MITM at this version would execute\n\t\t\t\/\/ arbitrary JS in every visitor's browser. Recompute via\n\t\t\t\/\/ `curl -sS <src> | openssl dgst -sha384 -binary | base64`\n\t\t\t\/\/ when bumping the version.\n\t\t\ts.integrity = 'sha384-stKllnUqA9AD0gsKCuUtf5XlqAW7PwIgDagoNsTWkjkBmJ\/GZ\/uHTgEBxdLV2VSK';\n\t\t\ts.async = true;\n\t\t\ts.crossOrigin = 'anonymous';\n\t\t\ts.onload = cb;\n\t\t\ts.onerror = function () { console.warn('[tm-tv-chart] failed to load lightweight-charts'); };\n\t\t\tdocument.head.appendChild(s);\n\t\t}\n\n\t\tfunction priceFormat(value) {\n\t\t\tvar abs = Math.abs(value);\n\t\t\tif (abs >= 0.01)    { return { precision: 2, minMove: 0.01 }; }\n\t\t\tif (abs >= 0.0001)  { return { precision: 6, minMove: 0.000001 }; }\n\t\t\treturn { precision: 8, minMove: 0.00000001 };\n\t\t}\n\t\tfunction formatPrice(value) {\n\t\t\tvar fmt = priceFormat(value);\n\t\t\treturn '$' + value.toLocaleString('en-US', { minimumFractionDigits: fmt.precision, maximumFractionDigits: fmt.precision });\n\t\t}\n\t\tfunction formatChangeAbs(value) {\n\t\t\tvar sign = value >= 0 ? '+' : '\u2212';\n\t\t\tvar abs  = Math.abs(value);\n\t\t\tvar fmt  = priceFormat(abs);\n\t\t\treturn sign + '$' + abs.toLocaleString('en-US', { minimumFractionDigits: fmt.precision, maximumFractionDigits: fmt.precision });\n\t\t}\n\t\tfunction updateQuote(figure, data) {\n\t\t\tvar priceEl  = figure.querySelector('[data-tm-chart-price]');\n\t\t\tvar changeEl = figure.querySelector('[data-tm-chart-change]');\n\t\t\tif (!priceEl || !changeEl || data.length === 0) { return; }\n\t\t\tvar last = data[data.length - 1];\n\t\t\tvar dayAgoTs = last.time - 86400;\n\t\t\tvar baseline = data[0];\n\t\t\tfor (var i = data.length - 1; i >= 0; i--) {\n\t\t\t\tif (data[i].time <= dayAgoTs) { baseline = data[i]; break; }\n\t\t\t}\n\t\t\tvar changeAbs = last.value - baseline.value;\n\t\t\tvar changePct = baseline.value !== 0 ? (changeAbs \/ baseline.value) * 100 : 0;\n\t\t\tpriceEl.textContent  = formatPrice(last.value);\n\t\t\tchangeEl.textContent = formatChangeAbs(changeAbs) + ' (' + (changePct >= 0 ? '+' : '\u2212') + Math.abs(changePct).toFixed(2) + '%)';\n\t\t\tchangeEl.classList.remove('tm-tv-chart__change--up', 'tm-tv-chart__change--down');\n\t\t\tif (changeAbs > 0) { changeEl.classList.add('tm-tv-chart__change--up'); }\n\t\t\telse if (changeAbs < 0) { changeEl.classList.add('tm-tv-chart__change--down'); }\n\t\t}\n\n\t\tfunction fetchOhlc(coinId, days) {\n\t\t\tvar url = 'https:\/\/api.coingecko.com\/api\/v3\/coins\/' + encodeURIComponent(coinId)\n\t\t\t\t+ '\/ohlc?vs_currency=usd&days=' + encodeURIComponent(days);\n\t\t\treturn fetch(url, { credentials: 'omit' }).then(function (r) {\n\t\t\t\tif (!r.ok) { throw new Error('coingecko ' + r.status); }\n\t\t\t\treturn r.json();\n\t\t\t}).then(function (rows) {\n\t\t\t\tif (!Array.isArray(rows)) { return []; }\n\t\t\t\treturn rows.map(function (k) {\n\t\t\t\t\treturn { time: Math.floor(k[0] \/ 1000), value: parseFloat(k[4]) };\n\t\t\t\t});\n\t\t\t});\n\t\t}\n\n\t\tfunction renderOne(figure) {\n\t\t\tif (figure.dataset.tmChartReady) { return; }\n\t\t\tif (figure.dataset.tmChartFetching) { return; }\n\t\t\tvar coinId = figure.getAttribute('data-tm-chart-id');\n\t\t\tvar days   = figure.getAttribute('data-tm-chart-days') || '14';\n\t\t\tvar height = parseInt(figure.getAttribute('data-tm-chart-height') || '220', 10);\n\t\t\tvar canvas = figure.querySelector('.tm-tv-chart__canvas');\n\t\t\tif (!coinId || !canvas) { return; }\n\t\t\t\/\/ Greptile P1 (PR #1470): only mark the figure ready AFTER\n\t\t\t\/\/ the OHLC fetch resolves successfully. The earlier flow set\n\t\t\t\/\/ the flag before the await, so a single 429 from CoinGecko\n\t\t\t\/\/ permanently disabled retry for that page-load \u2014 every\n\t\t\t\/\/ subsequent renderAll() call (e.g. on resize \/ hashchange)\n\t\t\t\/\/ would short-circuit on the stale flag and the chart would\n\t\t\t\/\/ stay blank forever. The intermediate `tmChartFetching`\n\t\t\t\/\/ flag still prevents in-flight double-fetches.\n\t\t\tfigure.dataset.tmChartFetching = '1';\n\n\t\t\tfetchOhlc(coinId, days).then(function (data) {\n\t\t\t\tif (!data || data.length === 0) {\n\t\t\t\t\tdelete figure.dataset.tmChartFetching;\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tfigure.dataset.tmChartReady = '1';\n\t\t\t\tdelete figure.dataset.tmChartFetching;\n\t\t\t\tfunction renderSvgChart() {\n\t\t\t\t\tvar w = 1000;\n\t\t\t\t\tvar compact = (canvas.getBoundingClientRect && canvas.getBoundingClientRect().width < 420);\n\t\t\t\t\tvar h = compact ? Math.max(190, height - 20) : height;\n\t\t\t\t\tvar pad = compact\n\t\t\t\t\t\t? { l: 18, r: 132, t: 14, b: 32 }\n\t\t\t\t\t\t: { l: 20, r: 96, t: 14, b: 34 };\n\t\t\t\t\tvar plotW = w - pad.l - pad.r;\n\t\t\t\t\tvar plotH = h - pad.t - pad.b;\n\t\t\t\t\tvar values = data.map(function (d) { return d.value; });\n\t\t\t\t\tvar rawMin = Math.min.apply(null, values);\n\t\t\t\t\tvar rawMax = Math.max.apply(null, values);\n\t\t\t\t\tvar rawSpan = Math.max(rawMax - rawMin, Math.abs(rawMax) * 0.01, 1);\n\t\t\t\t\tfunction niceStep(range, targetTicks) {\n\t\t\t\t\t\tvar rough = range \/ Math.max(1, targetTicks - 1);\n\t\t\t\t\t\tvar exponent = Math.pow(10, Math.floor(Math.log10(rough)));\n\t\t\t\t\t\tvar fraction = rough \/ exponent;\n\t\t\t\t\t\tvar niceFraction = fraction <= 1 ? 1 : fraction <= 2 ? 2 : fraction <= 5 ? 5 : 10;\n\t\t\t\t\t\treturn niceFraction * exponent;\n\t\t\t\t\t}\n\t\t\t\t\tvar step = niceStep(rawSpan * 1.16, 6);\n\t\t\t\t\tvar min = Math.floor((rawMin - rawSpan * 0.12) \/ step) * step;\n\t\t\t\t\tvar max = Math.ceil((rawMax + rawSpan * 0.12) \/ step) * step;\n\t\t\t\t\tvar span = Math.max(max - min, step);\n\t\t\t\t\tfunction x(i) { return pad.l + (data.length === 1 ? plotW : (i \/ (data.length - 1)) * plotW); }\n\t\t\t\t\tfunction y(v) { return pad.t + ((max - v) \/ span) * plotH; }\n\t\t\t\t\tfunction esc(s) { return String(s).replace(\/[&<>\\\"]\/g, function (c) { return ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '\"': '&quot;' })[c]; }); }\n\t\t\t\t\tfunction fmtTick(v) {\n\t\t\t\t\t\tif (Math.abs(v) >= 1000) {\n\t\t\t\t\t\t\treturn '$' + Math.round(v \/ 1000).toLocaleString('en-US') + 'K';\n\t\t\t\t\t\t}\n\t\t\t\t\t\treturn '$' + Math.round(v).toLocaleString('en-US');\n\t\t\t\t\t}\n\t\t\t\t\tfunction fmtDate(ts) { return new Date(ts * 1000).toLocaleDateString(undefined, { month: 'short', day: 'numeric', timeZone: 'UTC' }); }\n\t\t\t\t\tvar line = data.map(function (d, i) { return (i ? 'L' : 'M') + x(i).toFixed(1) + ' ' + y(d.value).toFixed(1); }).join(' ');\n\t\t\t\t\tvar area = line + ' L' + x(data.length - 1).toFixed(1) + ' ' + (pad.t + plotH).toFixed(1) + ' L' + pad.l + ' ' + (pad.t + plotH).toFixed(1) + ' Z';\n\t\t\t\t\tvar grid = '';\n\t\t\t\t\tfor (var gv = max; gv >= min - step * 0.5; gv -= step) {\n\t\t\t\t\t\tvar gy = y(gv);\n\t\t\t\t\t\tgrid += '<line x1=\"' + pad.l + '\" y1=\"' + gy.toFixed(1) + '\" x2=\"' + (pad.l + plotW) + '\" y2=\"' + gy.toFixed(1) + '\" stroke=\"' + TM_BRAND.grid + '\"\/>';\n\t\t\t\t\t\tgrid += '<text x=\"' + (pad.l + plotW + 10) + '\" y=\"' + (gy + 4).toFixed(1) + '\" fill=\"rgba(232,234,242,.72)\" font-size=\"20\">' + esc(fmtTick(gv)) + '<\/text>';\n\t\t\t\t\t}\n\t\t\t\t\tvar labels = '';\n\t\t\t\t\t[0, Math.floor((data.length - 1) \/ 2), data.length - 1].forEach(function (idx, n) {\n\t\t\t\t\t\tlabels += '<text x=\"' + x(idx).toFixed(1) + '\" y=\"' + (h - 9) + '\" text-anchor=\"' + (n === 0 ? 'start' : n === 2 ? 'end' : 'middle') + '\" fill=\"rgba(232,234,242,.62)\" font-size=\"' + (compact ? 24 : 20) + '\">' + esc(fmtDate(data[idx].time)) + '<\/text>';\n\t\t\t\t\t});\n\t\t\t\t\tcanvas.innerHTML = '<svg class=\"tm-tv-chart__svg\" viewBox=\"0 0 ' + w + ' ' + h + '\" width=\"100%\" height=\"100%\" preserveAspectRatio=\"none\" role=\"presentation\" aria-hidden=\"true\">'\n\t\t\t\t\t\t+ '<defs><linearGradient id=\"tm-chart-fill-' + Math.random().toString(36).slice(2) + '\" x1=\"0\" x2=\"0\" y1=\"0\" y2=\"1\"><stop offset=\"0%\" stop-color=\"rgba(255,214,10,.38)\"\/><stop offset=\"100%\" stop-color=\"rgba(255,214,10,0)\"\/><\/linearGradient><\/defs>'\n\t\t\t\t\t\t+ '<rect x=\"0\" y=\"0\" width=\"' + w + '\" height=\"' + h + '\" fill=\"' + TM_BRAND.bg + '\"\/>'\n\t\t\t\t\t\t+ grid\n\t\t\t\t\t\t+ '<path d=\"' + area + '\" fill=\"rgba(255,214,10,.18)\"\/>'\n\t\t\t\t\t\t+ '<path d=\"' + line + '\" fill=\"none\" stroke=\"' + TM_BRAND.line + '\" stroke-width=\"5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/>'\n\t\t\t\t\t\t+ labels\n\t\t\t\t\t\t+ '<\/svg>';\n\t\t\t\t}\n\t\t\t\trenderSvgChart();\n\t\t\t\tupdateQuote(figure, data);\n\t\t\t\tif (window.ResizeObserver) {\n\t\t\t\t\tvar ro = new ResizeObserver(renderSvgChart);\n\t\t\t\t\tro.observe(canvas);\n\t\t\t\t}\n\t\t\t}).catch(function (err) {\n\t\t\t\t\/\/ Greptile P1 (PR #1470): clear the in-flight flag on\n\t\t\t\t\/\/ failure so a future renderAll() can retry. Without\n\t\t\t\t\/\/ this, a 429 from CoinGecko leaves the figure\n\t\t\t\t\/\/ permanently in a half-loaded state.\n\t\t\t\tdelete figure.dataset.tmChartFetching;\n\t\t\t\tconsole.warn('[tm-tv-chart] data fetch failed for ' + coinId, err);\n\t\t\t});\n\t\t}\n\n\t\tfunction renderAll() {\n\t\t\tvar figures = document.querySelectorAll('[data-tm-chart]');\n\t\t\tif (figures.length === 0) { return; }\n\t\t\tfigures.forEach(renderOne);\n\t\t}\n\n\t\tif (document.readyState === 'loading') {\n\t\t\tdocument.addEventListener('DOMContentLoaded', renderAll);\n\t\t} else {\n\t\t\trenderAll();\n\t\t}\n\t})();\n\t<\/script>\n\t\t\n<h2>What Token Metrics Data Shows<\/h2>\n<p>Data as of May 26, 2026. Token Metrics technicals on APT read bullish despite the security news. The trend is bullish and momentum is strong. The token moves with high volatility. APT trades near $0.99, up about 3% today and 6% this week. First support is near $0.86. Next resistance is around $1.18.<\/p>\n<p>The next big event is a token unlock on Jun 12. This is the main fundamental event in the next 7 days. Token Metrics Daily Pulse called this a main items story. This shows its importance to the market. The malware news could cause short-term fear. But the technical picture shows buying pressure remains strong.<\/p>\n<p>High volatility means traders expect big moves. The bullish trend shows they think the moves will be up. The token unlock adds more risk for APT traders. The momentum indicator confirms bullish momentum. While the momentum reading of 65 indicates the token is approaching overbought territory but still has room to run. The trend strength reading of 28.5 shows a strengthening trend, while the trend bias turning bearish suggests caution. Price positioning near the upper band confirms recent strength. The price range state indicates consolidation might be needed before the next leg up.<\/p>\n\t\t<aside\n\t\tclass=\"tm-token-stats\"\n\t\tdata-tm-token-stats\n\t\tdata-tm-stats-id=\"aptos\"\n\t\tdata-tm-stats-lookback=\"365\"\n\t\taria-label=\"Aptos key statistics\"\n\t>\n\t\t<header class=\"tm-token-stats__header\">\n\t\t\t<h3 class=\"tm-token-stats__title\">Aptos \u00b7 Key Stats<\/h3>\n\t\t\t<span class=\"tm-token-stats__lookback\">365d lookback<\/span>\n\t\t<\/header>\n\t\t<section class=\"tm-token-stats__section\">\n\t\t\t<h4 class=\"tm-token-stats__section-label\">Market<\/h4>\n\t\t\t<dl class=\"tm-token-stats__grid\">\n\t\t\t\t<div class=\"tm-token-stats__cell\"><dt>Market Cap<\/dt><dd data-tm-stats-value=\"market-cap\">\u2014<\/dd><\/div>\n\t\t\t\t<div class=\"tm-token-stats__cell\"><dt>Vol \/ Cap<\/dt><dd data-tm-stats-value=\"turnover\">\u2014<\/dd><\/div>\n\t\t\t\t<div class=\"tm-token-stats__cell\"><dt>52-Week Range<\/dt><dd data-tm-stats-value=\"range-52w\">\u2014<\/dd><\/div>\n\t\t\t<\/dl>\n\t\t<\/section>\n\t\t<section class=\"tm-token-stats__section\">\n\t\t\t<h4 class=\"tm-token-stats__section-label\">Performance<\/h4>\n\t\t\t<dl class=\"tm-token-stats__grid\">\n\t\t\t\t<div class=\"tm-token-stats__cell\"><dt>30d<\/dt><dd data-tm-stats-value=\"change-30d\">\u2014<\/dd><\/div>\n\t\t\t\t<div class=\"tm-token-stats__cell\"><dt>1y<\/dt><dd data-tm-stats-value=\"change-1y\">\u2014<\/dd><\/div>\n\t\t\t\t<div class=\"tm-token-stats__cell\"><dt>vs BTC<\/dt><dd data-tm-stats-value=\"vs-btc\">\u2014<\/dd><\/div>\n\t\t\t<\/dl>\n\t\t<\/section>\n\t\t<section class=\"tm-token-stats__section\">\n\t\t\t<h4 class=\"tm-token-stats__section-label\">Risk (1y)<\/h4>\n\t\t\t<dl class=\"tm-token-stats__grid\">\n\t\t\t\t<div class=\"tm-token-stats__cell\"><dt>Volatility<\/dt><dd data-tm-stats-value=\"volatility\">\u2014<\/dd><\/div>\n\t\t\t\t<div class=\"tm-token-stats__cell\"><dt>Max Drawdown<\/dt><dd data-tm-stats-value=\"max-drawdown\">\u2014<\/dd><\/div>\n\t\t\t\t<div class=\"tm-token-stats__cell\"><dt>Sharpe<\/dt><dd data-tm-stats-value=\"sharpe\">\u2014<\/dd><\/div>\n\t\t\t<\/dl>\n\t\t<\/section>\n\t\t<p class=\"tm-token-stats__source\">Data via CoinGecko. Risk metrics from the trailing daily closes.<\/p>\n\t<\/aside>\n\t\t<script id=\"tm-token-stats-hydrator\">\n\t(function () {\n\t\t\/\/ Routed through the tm-coingecko-proxy Worker (5-min KV cache,\n\t\t\/\/ paid Pro key) instead of api.coingecko.com directly. Base URL is\n\t\t\/\/ resolved server-side from the `tm_token_card_coingecko_proxy_base`\n\t\t\/\/ filter \/ TM_COINGECKO_PROXY_BASE constant so staging can point\n\t\t\/\/ at a separate Worker.\n\t\tvar PROXY_BASE = \"https:\\\/\\\/tokenmetrics.com\\\/api\\\/cg\";\n\t\tvar DAYS_PER_YEAR = 365;\n\t\tvar coinCache = {};\n\t\tfunction fetchJson(url) {\n\t\t\treturn fetch(url, { credentials: 'omit' }).then(function (r) {\n\t\t\t\tif (!r.ok) { throw new Error('coingecko ' + r.status); }\n\t\t\t\treturn r.json();\n\t\t\t});\n\t\t}\n\t\tfunction fetchSnapshot(id) {\n\t\t\tif (coinCache['snap_' + id]) { return coinCache['snap_' + id]; }\n\t\t\tvar url = PROXY_BASE + '\/coins\/' + encodeURIComponent(id)\n\t\t\t\t+ '?localization=false&tickers=false&community_data=false&developer_data=false&sparkline=false';\n\t\t\tcoinCache['snap_' + id] = fetchJson(url);\n\t\t\treturn coinCache['snap_' + id];\n\t\t}\n\t\tfunction fetchSeries(id, days) {\n\t\t\tvar key = 'series_' + id + '_' + days;\n\t\t\tif (coinCache[key]) { return coinCache[key]; }\n\t\t\tvar url = PROXY_BASE + '\/coins\/' + encodeURIComponent(id)\n\t\t\t\t+ '\/market_chart?vs_currency=usd&days=' + encodeURIComponent(days);\n\t\t\tcoinCache[key] = fetchJson(url).then(function (d) {\n\t\t\t\treturn Array.isArray(d.prices) ? d.prices : [];\n\t\t\t});\n\t\t\treturn coinCache[key];\n\t\t}\n\t\tfunction fmtUsd(value) {\n\t\t\tvar abs = Math.abs(value);\n\t\t\tvar precision = abs >= 0.01 ? 2 : (abs >= 0.0001 ? 6 : 8);\n\t\t\treturn '$' + value.toLocaleString('en-US', { minimumFractionDigits: precision, maximumFractionDigits: precision });\n\t\t}\n\t\tfunction fmtCompactUsd(value) {\n\t\t\tif (value === null || value === undefined || isNaN(value)) { return '\u2014'; }\n\t\t\tvar abs = Math.abs(value);\n\t\t\tif (abs >= 1e12) { return '$' + (value \/ 1e12).toFixed(2) + 'T'; }\n\t\t\tif (abs >= 1e9)  { return '$' + (value \/ 1e9).toFixed(2)  + 'B'; }\n\t\t\tif (abs >= 1e6)  { return '$' + (value \/ 1e6).toFixed(2)  + 'M'; }\n\t\t\tif (abs >= 1e3)  { return '$' + (value \/ 1e3).toFixed(2)  + 'K'; }\n\t\t\treturn fmtUsd(value);\n\t\t}\n\t\tfunction fmtPct(value) {\n\t\t\tif (value === null || value === undefined || isNaN(value)) { return '\u2014'; }\n\t\t\tvar sign = value >= 0 ? '+' : '\u2212';\n\t\t\treturn sign + Math.abs(value).toFixed(2) + '%';\n\t\t}\n\t\tfunction trendOf(value) {\n\t\t\tif (value === null || value === undefined || isNaN(value)) { return null; }\n\t\t\tif (value > 0) { return 'up'; }\n\t\t\tif (value < 0) { return 'down'; }\n\t\t\treturn null;\n\t\t}\n\t\tfunction setCell(root, key, text, trend) {\n\t\t\tvar el = root.querySelector('[data-tm-stats-value=\"' + key + '\"]');\n\t\t\tif (!el) { return; }\n\t\t\tel.textContent = text;\n\t\t\tif (trend === 'up' || trend === 'down') { el.setAttribute('data-trend', trend); }\n\t\t\telse { el.removeAttribute('data-trend'); }\n\t\t}\n\t\tfunction dailyReturns(prices) {\n\t\t\tvar rets = [];\n\t\t\tfor (var i = 1; i < prices.length; i++) {\n\t\t\t\tvar prev = prices[i - 1][1], cur = prices[i][1];\n\t\t\t\tif (prev > 0 && isFinite(prev) && isFinite(cur)) { rets.push(cur \/ prev - 1); }\n\t\t\t}\n\t\t\treturn rets;\n\t\t}\n\t\tfunction mean(arr) {\n\t\t\tif (arr.length === 0) { return 0; }\n\t\t\tvar s = 0; for (var i = 0; i < arr.length; i++) { s += arr[i]; }\n\t\t\treturn s \/ arr.length;\n\t\t}\n\t\tfunction stddev(arr, mu) {\n\t\t\tif (arr.length < 2) { return 0; }\n\t\t\tvar s = 0;\n\t\t\tfor (var i = 0; i < arr.length; i++) { var d = arr[i] - mu; s += d * d; }\n\t\t\treturn Math.sqrt(s \/ (arr.length - 1));\n\t\t}\n\t\tfunction maxDrawdown(prices) {\n\t\t\tif (prices.length < 2) { return { value: 0, duration: 0 }; }\n\t\t\tvar peak = prices[0][1], peakIdx = 0;\n\t\t\tvar maxDd = 0, troughIdx = 0, troughPeakIdx = 0;\n\t\t\tfor (var i = 1; i < prices.length; i++) {\n\t\t\t\tvar p = prices[i][1];\n\t\t\t\tif (p > peak) { peak = p; peakIdx = i; }\n\t\t\t\tif (peak > 0) {\n\t\t\t\t\tvar dd = (p - peak) \/ peak;\n\t\t\t\t\tif (dd < maxDd) { maxDd = dd; troughIdx = i; troughPeakIdx = peakIdx; }\n\t\t\t\t}\n\t\t\t}\n\t\t\tvar duration = 0;\n\t\t\tif (prices[troughIdx] && prices[troughPeakIdx]) {\n\t\t\t\tvar ms = prices[troughIdx][0] - prices[troughPeakIdx][0];\n\t\t\t\tduration = Math.max(0, Math.round(ms \/ 86400000));\n\t\t\t}\n\t\t\treturn { value: maxDd, duration: duration };\n\t\t}\n\t\tfunction quantStats(prices) {\n\t\t\tif (!prices || prices.length < 30) { return null; }\n\t\t\tvar rets = dailyReturns(prices);\n\t\t\tif (rets.length === 0) { return null; }\n\t\t\tvar mu = mean(rets);\n\t\t\tvar sd = stddev(rets, mu);\n\t\t\tvar ann_mu = mu * DAYS_PER_YEAR;\n\t\t\tvar ann_sd = sd * Math.sqrt(DAYS_PER_YEAR);\n\t\t\tvar dd = maxDrawdown(prices);\n\t\t\treturn {\n\t\t\t\tvolatility:      ann_sd,\n\t\t\t\tmaxDrawdown:     dd.value,\n\t\t\t\tmaxDrawdownDays: dd.duration,\n\t\t\t\tsharpe:          ann_sd > 0 ? ann_mu \/ ann_sd : 0\n\t\t\t};\n\t\t}\n\t\tfunction totalReturn(prices) {\n\t\t\tif (!prices || prices.length < 2) { return null; }\n\t\t\tvar first = prices[0][1], last = prices[prices.length - 1][1];\n\t\t\tif (!isFinite(first) || !isFinite(last) || first <= 0) { return null; }\n\t\t\treturn last \/ first - 1;\n\t\t}\n\t\tfunction setRangeCell(root, key, low, current, high) {\n\t\t\tvar el = root.querySelector('[data-tm-stats-value=\"' + key + '\"]');\n\t\t\tif (!el) { return; }\n\t\t\tel.removeAttribute('data-trend');\n\t\t\tif (!isFinite(low) || !isFinite(high) || !isFinite(current) || high <= low) {\n\t\t\t\tel.textContent = '\u2014'; return;\n\t\t\t}\n\t\t\tvar pct = ((current - low) \/ (high - low)) * 100;\n\t\t\tpct = Math.max(0, Math.min(100, pct));\n\t\t\tel.innerHTML = '';\n\t\t\tvar wrap = document.createElement('div'); wrap.className = 'tm-token-stats__range';\n\t\t\tvar track = document.createElement('div'); track.className = 'tm-token-stats__range-track';\n\t\t\tvar dot = document.createElement('div'); dot.className = 'tm-token-stats__range-dot';\n\t\t\tdot.style.left = pct.toFixed(1) + '%';\n\t\t\ttrack.appendChild(dot);\n\t\t\tvar bounds = document.createElement('div'); bounds.className = 'tm-token-stats__range-bounds';\n\t\t\tvar loSpan = document.createElement('span'); loSpan.textContent = fmtUsd(low);\n\t\t\tvar hiSpan = document.createElement('span'); hiSpan.textContent = fmtUsd(high);\n\t\t\tbounds.appendChild(loSpan); bounds.appendChild(hiSpan);\n\t\t\twrap.appendChild(track); wrap.appendChild(bounds); el.appendChild(wrap);\n\t\t}\n\t\tfunction renderOne(root) {\n\t\t\tif (root.dataset.tmStatsReady) { return; }\n\t\t\tvar coinId = root.getAttribute('data-tm-stats-id');\n\t\t\tvar lookback = root.getAttribute('data-tm-stats-lookback') || '365';\n\t\t\tif (!coinId) { return; }\n\t\t\troot.dataset.tmStatsReady = '1';\n\t\t\tPromise.all([\n\t\t\t\tfetchSnapshot(coinId),\n\t\t\t\tfetchSeries(coinId, lookback),\n\t\t\t\tfetchSeries('bitcoin', lookback)\n\t\t\t]).then(function (results) {\n\t\t\t\tvar snap = results[0]; var prices = results[1]; var btcPrices = results[2];\n\t\t\t\tvar md = (snap && snap.market_data) || {};\n\t\t\t\tsetCell(root, 'market-cap', fmtCompactUsd(md.market_cap && md.market_cap.usd));\n\t\t\t\tvar vol = md.total_volume && md.total_volume.usd;\n\t\t\t\tvar mcap = md.market_cap && md.market_cap.usd;\n\t\t\t\tvar turnoverText = '\u2014';\n\t\t\t\tif (vol && mcap && mcap > 0) {\n\t\t\t\t\tturnoverText = fmtCompactUsd(vol) + ' (' + ((vol \/ mcap) * 100).toFixed(2) + '%)';\n\t\t\t\t} else if (vol) { turnoverText = fmtCompactUsd(vol); }\n\t\t\t\tsetCell(root, 'turnover', turnoverText);\n\t\t\t\tif (prices && prices.length > 1) {\n\t\t\t\t\tvar lo = Infinity, hi = -Infinity;\n\t\t\t\t\tfor (var i = 0; i < prices.length; i++) {\n\t\t\t\t\t\tvar p = prices[i][1];\n\t\t\t\t\t\tif (p < lo) { lo = p; } if (p > hi) { hi = p; }\n\t\t\t\t\t}\n\t\t\t\t\tvar cur = (md.current_price && md.current_price.usd) || prices[prices.length - 1][1];\n\t\t\t\t\tsetRangeCell(root, 'range-52w', lo, cur, hi);\n\t\t\t\t}\n\t\t\t\tsetCell(root, 'change-30d', fmtPct(md.price_change_percentage_30d), trendOf(md.price_change_percentage_30d));\n\t\t\t\tsetCell(root, 'change-1y',  fmtPct(md.price_change_percentage_1y),  trendOf(md.price_change_percentage_1y));\n\t\t\t\tvar tokenRet = totalReturn(prices), btcRet = totalReturn(btcPrices);\n\t\t\t\tif (tokenRet !== null && btcRet !== null) {\n\t\t\t\t\tvar vsBtc = (tokenRet - btcRet) * 100;\n\t\t\t\t\tsetCell(root, 'vs-btc', fmtPct(vsBtc), trendOf(vsBtc));\n\t\t\t\t}\n\t\t\t\tvar qs = quantStats(prices);\n\t\t\t\tvar btcQs = quantStats(btcPrices);\n\t\t\t\tif (qs) {\n\t\t\t\t\tsetCell(root, 'volatility', (qs.volatility * 100).toFixed(1) + '%');\n\t\t\t\t\tvar ddText = fmtPct(qs.maxDrawdown * 100);\n\t\t\t\t\tif (qs.maxDrawdownDays > 0) { ddText += ' (' + qs.maxDrawdownDays + 'd)'; }\n\t\t\t\t\tsetCell(root, 'max-drawdown', ddText, 'down');\n\t\t\t\t\tvar sharpeText = qs.sharpe.toFixed(2);\n\t\t\t\t\tif (btcQs && btcQs.sharpe !== 0) { sharpeText += ' \u00b7 BTC ' + btcQs.sharpe.toFixed(2); }\n\t\t\t\t\tsetCell(root, 'sharpe', sharpeText, trendOf(qs.sharpe));\n\t\t\t\t}\n\t\t\t}).catch(function (err) { console.warn('[tm-token-stats] fetch failed for ' + coinId, err); });\n\t\t}\n\t\tfunction renderAll() {\n\t\t\tvar roots = document.querySelectorAll('[data-tm-token-stats]');\n\t\t\troots.forEach(renderOne);\n\t\t}\n\t\tif (document.readyState === 'loading') {\n\t\t\tdocument.addEventListener('DOMContentLoaded', renderAll);\n\t\t} else {\n\t\t\trenderAll();\n\t\t}\n\t})();\n\t<\/script>\n\t\t\n\t\t<aside\n\t\tclass=\"tm-token-card\"\n\t\trole=\"complementary\"\n\t\taria-label=\"Track Aptos (APT) with Token Metrics\"\n\t\tdata-tm-token-card=\"apt\"\n\t>\n\t\t<header class=\"tm-token-card__header\">\n\t\t\t<p class=\"tm-token-card__eyebrow\">Track this token with Token Metrics<\/p>\n\t\t\t<h3 class=\"tm-token-card__title\">\n\t\t\t\t<span class=\"tm-token-card__name\">Aptos<\/span>\n\t\t\t\t<span class=\"tm-token-card__ticker\">APT<\/span>\n\t\t\t<\/h3>\n\t\t<\/header>\n\t\t<ul class=\"tm-token-card__benefits\">\n\t\t\t\t\t\t\t<li class=\"tm-token-card__benefit\">7-day free trial of Signal<\/li>\n\t\t\t\t\t\t\t<li class=\"tm-token-card__benefit\">Smart-money wallet flows across the top tokens<\/li>\n\t\t\t\t\t\t\t<li class=\"tm-token-card__benefit\">Daily technical setup labels \u2014 Bullish to Bearish, both directions<\/li>\n\t\t\t\t\t\t\t<li class=\"tm-token-card__benefit\">Polymarket consensus on near-term catalysts<\/li>\n\t\t\t\t\t<\/ul>\n\t\t<div class=\"tm-token-card__footer\">\n\t\t\t<a\n\t\t\t\tclass=\"tm-token-card__cta\"\n\t\t\t\thref=\"https:\/\/tokenmetrics.com\/?utm_source=tm_blog&#038;utm_medium=token_card&#038;utm_campaign=signal_apt#premium\"\n\t\t\t\trel=\"noopener\"\n\t\t\t\ttarget=\"_blank\"\n\t\t\t>See the setup, risk, and invalidation before you act \u2192<\/a>\n\t\t\t<span class=\"tm-token-card__meta\">Signal alerts include the setup, risk, and what would change the trade.<\/span>\n\t\t<\/div>\n\t<\/aside>\n\t\n<h2>What&#8217;s New<\/h2>\n<p>The TrapDoor campaign is a coordinated supply-chain attack. It targets crypto development environments. Socket Security researchers found over 34 malicious packages. They were spread across three major package registries: npm for JavaScript, PyPI for Python, and Crates.io for Rust. These packages target developers working with Aptos, Sui, and Solana blockchains.<\/p>\n<p>The attack gets its name from its method. It creates trapdoors in the software supply chain. These let attackers steal data automatically. The campaign is dangerous because it blends into normal developer work. It uses legitimate package features like postinstall scripts. So the malware runs with no clear warning signs.<\/p>\n<p>The first malicious package, eth-security-auditor@0.1.0, went to PyPI on May 22. More bad releases followed through May 25. Socket&#8217;s detection caught them fast. The average response time was just over 5 minutes.<\/p>\n<p>The malware targets data specific to crypto development. It steals wallet keystores for Aptos, Sui, and Solana. It also looks for SSH keys, AWS credentials, GitHub tokens, browser data, and crypto wallet extension files.<\/p>\n<p>The npm payload shows advanced skills. It uses multiple encryption methods. It checks stolen credentials through live API calls. This helps find valuable targets. Persistence methods keep the malware active even after reboots. The attack also targets AI coding assistant setups. This shows knowledge of modern development practices.<\/p>\n<p>The attacker called this a Universal AI Agent Extraction Framework. This might be an early version. More advanced attacks could come.<\/p>\n<h2>What to Watch<\/h2>\n<ul>\n<li>Check package registry security advisories for npm, PyPI, and Crates.io. Look for new TrapDoor variants or similar attacks.<\/li>\n<li>Watch for news from Aptos, Sui, or Solana foundations. They may share security tips or respond to the TrapDoor campaign.<\/li>\n<li>Track APT&#8217;s technical momentum around the Jun 12 token unlock. High volatility could make security news have more impact.<\/li>\n<li>Monitor GitHub Gist repositories and data dump sites. Look for unusual dumps of wallet keys or dev credentials.<\/li>\n<li>Watch for more warnings from firms like SlowMist. Check for updates on alert SM-2026-352284 as more details emerge.<\/li>\n<\/ul>\n<p>This information is for educational purposes only and should not be considered financial advice.<\/p>\n","protected":false},"excerpt":{"rendered":"Socket Security discovered 34+ malicious packages targeting Aptos, Sui, and Solana developers, exfiltrating wallet keys and credentials while blending into normal workflows.","protected":false},"author":1,"featured_media":2380,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_tm_paid_cta_tier":"","_tm_paid_cta_heading":"","_tm_paid_cta_body":"","csco_display_header_overlay":false,"csco_singular_sidebar":"","csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_reading_time":"","csco_page_toc_navigation":"","csco_post_video_location":[],"csco_post_video_location_hash":"","csco_post_video_url":"","csco_post_video_bg_start_time":0,"csco_post_video_bg_end_time":0,"csco_post_video_bg_volume":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[419,158],"tags":[424,422,283,421,423],"sections":[183],"entities":[420],"class_list":["post-2381","post","type-post","status-publish","format-standard","has-post-thumbnail","category-apt","category-news","tag-aptos","tag-malware","tag-security","tag-socket-security","tag-supply-chain-attack","section-news","entity-apt","cs-entry","cs-video-wrap"],"jetpack_featured_media_url":"https:\/\/tokenmetrics.com\/blog\/wp-content\/uploads\/2026\/05\/trapdoor-malware-campaign-crypto-developers-featured.webp","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/posts\/2381","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/comments?post=2381"}],"version-history":[{"count":6,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/posts\/2381\/revisions"}],"predecessor-version":[{"id":5921,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/posts\/2381\/revisions\/5921"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/media\/2380"}],"wp:attachment":[{"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/media?parent=2381"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/categories?post=2381"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/tags?post=2381"},{"taxonomy":"section","embeddable":true,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/sections?post=2381"},{"taxonomy":"entity","embeddable":true,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/entities?post=2381"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}