On October 30, 2024, attackers phished a LottieFiles npm account and published malicious lottie-player versions that injected an Ace Drainer wallet-connect prompt into every downstream site, including the 1inch web dApp. The 1inch frontend lacked npm package pinning or integrity checks, leaving it vulnerable to upstream compromise. One user lost 10 wrapped BTC ($723K) from an Avalanche wallet; only the web frontend was affected.