The StepSecurity threat intelligence team discovered that dev-protocol, a verified GitHub organization with 568 followers belonging to a legitimate Japanese DeFi project, has been hijacked. The compromised organization is now being used to distribute malicious Polymarket trading bots that steal wallet keys. This represents a significant supply chain attack targeting cryptocurrency users through a trusted development platform.