Earlier today, at around 9:30 AM ET, an attacker compromised all packages published by qix, including extremely popular packages such as chalk and debug-js. Collectively, the packages have over 2 billion downloads per week, making this likely the largest supply chain attack in history.
Method of Compromise
The author was compromised by a phishing email sent from support@npmjs[.]help. At the time of writing, this domain is no longer accessible, but records show that it once resolved to 185.7.81.108.
This email contained a link to https://www.npmjs[.]help/settings/qix/tfa/manageTfa?action=setup-totp, which loaded content from two attacker-controlled BunnyCDN buckets: static-mw-host.b-cdn[.]net and img-data-backup.b-cdn[.]net.
One of the scripts loaded was the credential stealer, which can be found here. This is a simple script which stores the provided username, password, and 2FA code, and sends it to a remote host at websocket-api2.publicvm[.]com.
Malware Analysis
Once the account was compromised, the attacker published updates to all packages and embedded a crypto stealer. A sample from one such package can be found here.
This stealer is not designed for desktop environments and does not attempt to read any files or install any malware. Rather, it checks if window.ethereum exists, and if so installs hooks on the request, send, and sendAsync functions. It also overwrites the fetch and XMLHttpRequest.prototype.open and XMLHttpRequest.prototype.send functions. Notably, it did not check if fetch is defined, which raised errors in CI/CD environments.
If window.ethereum is hooked, it intercepts both Ethereum and Solana requests. For Ethereum requests, it overwrites the destination address of any call to approve, permit, transfer, and transferFrom to 0xFc4a4858bafef54D1b1d7697bfb5c52F4c166976. It also overwrites the destination of any transaction with value or with no data to the same address. For Solana requests, it overwrites the recipient, destination, and keys on each account to 19111111111111111111111111111111, effectively breaking the transaction.
For any network requests made over fetch or XMLHttpRequest, it overwrites all JSON responses and performs a simple string replace on any substring that looks like a crypto address with one of 280 hardcoded addresses. It uses the Levenshtein distance to calculate the address that has the closest edit distance to the original address.
Impact
Despite the magnitude of the breach, the attacker appears to have only “stolen” around 5 cents of ETH and 20 USD of a memecoin with a whopping 588 USD of trading volume over the past 24 hours. Indeed, it seems like the biggest financial impact of this entire incident will be the collective thousands of hours spent by engineering and security teams around the world working to clean compromised environments, and the millions of dollars of sales contracts that will inevitably be signed as a result of this new case study.
Remediation
If you are a package maintainer, there are a few ways you can check if you have been impacted, including:
node_modules to see if it contains the malware: grep -R 'checkethereumw'If you are a user, make sure you are double checking any transactions you are signing to make sure the addresses are correct. For more information, you can refer to the SEAL Framework on signing and verifying transactions.
IoCs
npmjs[.]help
static-mw-host.b-cdn[.]net
img-data-backup.b-cdn[.]net
websocket-api2.publicvm[.]com
185[.]7.81.108
1H13VnQJKtT4HjD5ZFKaaiZEetMbG7nDHx
1Li1CRPwjovnGHGPTtcKzy75j37K6n97Rd
1Dk12ey2hKWJctU3V8Akc1oZPo1ndjbnjP
1NBvJqc1GdSb5uuX8vT7sysxtT4LB8GnuY
1Mtv6GsFsbno9XgSGuG6jRXyBYv2tgVhMj
1BBAQm4DL78JtRdJGEfzDBT2PBkGyvzf4N
1KkovSeka94yC5K4fDbfbvZeTFoorPggKW
18CPyFLMdncoYccmsZPnJ5T1hxFjh6aaiV
1BijzJvYU2GaBCYHa8Hf3PnJh6mjEd92UP
1Bjvx6WXt9iFB5XKAVsU3TgktgeNbzpn5N
19fUECa9aZCQxcLeo8FZu8kh5kVWheVrg8
1DZEep7GsnmBVkbZR3ogeBQqwngo6x4XyR
1GX1FWYttd65J26JULr9HLr98K7VVUE38w
14mzwvmF2mUd6ww1gtanQm8Bxv3ZWmxDiC
1EYHCtXyKMMhUiJxXJH4arfpErNto5j87k
19D1QXVQCoCLUHUrzQ4rTumqs9jBcvXiRg
16mKiSoZNTDaYLBQ5LkunK6neZFVV14b7X
18x8S4yhFmmLUpZUZa3oSRbAeg8cpECpne
1EkdNoZJuXTqBeaFVzGwp3zHuRURJFvCV8
13oBVyPUrwbmTAbwxVDMT9i6aVUgm5AnKM
1DwsWaXLdsn4pnoMtbsmzbH7rTj5jNH6qS
13wuEH28SjgBatNppqgoUMTWwuuBi9e4tJ
154jc6v7YwozhFMppkgSg3BdgpaFPtCqYn
1AP8zLJE6nmNdkfrf1piRqTjpasw7vk5rb
19F8YKkU7z5ZDAypxQ458iRqH2ctGJFVCn
17J3wL1SapdZpT2ZVX72Jm5oMSXUgzSwKS
16z8D7y3fbJsWFs3U8RvBF3A8HLycCW5fH
1PYtCvLCmnGDNSVK2gFE37FNSf69W2wKjP
143wdqy6wgY3ez8Nm19AqyYh25AZHz3FUp
1JuYymZbeoDeH5q65KZVG3nBhYoTK9YXjm
1PNM2L1bpJQWipuAhNuB7BZbaFLB3LCuju
19onjpqdUsssaFKJjwuAQGi2eS41vE19oi
1JQ15RHehtdnLAzMcVT9kU8qq868xFEUsS
1LVpMCURyEUdE8VfsGqhMvUYVrLzbkqYwf
1KMcDbd2wecP4Acoz9PiZXsBrJXHbyPyG6
1DZiXKhBFiKa1f6PTGCNMKSU1xoW3Edb7Z
174bEk62kr8dNgiduwHgVzeLgLQ38foEgZ
17cvmxcjTPSBsF1Wi2HfcGXnpLBSzbAs6p
1NoYvnedUqNshKPZvSayfk8YTQYvoB2wBc
13694eCkAtBRkip8XdPQ8ga99KEzyRnU6a
1H13VnQJKtT4HjD5ZFKaaiZEetMbG7nDHx
1Li1CRPwjovnGHGPTtcKzy75j37K6n97Rd
1Dk12ey2hKWJctU3V8Akc1oZPo1ndjbnjP
1NBvJqc1GdSb5uuX8vT7sysxtT4LB8GnuY
1Mtv6GsFsbno9XgSGuG6jRXyBYv2tgVhMj
1BBAQm4DL78JtRdJGEfzDBT2PBkGyvzf4N
1KkovSeka94yC5K4fDbfbvZeTFoorPggKW
18CPyFLMdncoYccmsZPnJ5T1hxFjh6aaiV
1BijzJvYU2GaBCYHa8Hf3PnJh6mjEd92UP
1Bjvx6WXt9iFB5XKAVsU3TgktgeNbzpn5N
19fUECa9aZCQxcLeo8FZu8kh5kVWheVrg8
1DZEep7GsnmBVkbZR3ogeBQqwngo6x4XyR
1GX1FWYttd65J26JULr9HLr98K7VVUE38w
14mzwvmF2mUd6ww1gtanQm8Bxv3ZWmxDiC
1EYHCtXyKMMhUiJxXJH4arfpErNto5j87k
19D1QXVQCoCLUHUrzQ4rTumqs9jBcvXiRg
16mKiSoZNTDaYLBQ5LkunK6neZFVV14b7X
18x8S4yhFmmLUpZUZa3oSRbAeg8cpECpne
1EkdNoZJuXTqBeaFVzGwp3zHuRURJFvCV8
13oBVyPUrwbmTAbwxVDMT9i6aVUgm5AnKM
1DwsWaXLdsn4pnoMtbsmzbH7rTj5jNH6qS
13wuEH28SjgBatNppqgoUMTWwuuBi9e4tJ
154jc6v7YwozhFMppkgSg3BdgpaFPtCqYn
1AP8zLJE6nmNdkfrf1piRqTjpasw7vk5rb
19F8YKkU7z5ZDAypxQ458iRqH2ctGJFVCn
17J3wL1SapdZpT2ZVX72Jm5oMSXUgzSwKS
16z8D7y3fbJsWFs3U8RvBF3A8HLycCW5fH
1PYtCvLCmnGDNSVK2gFE37FNSf69W2wKjP
143wdqy6wgY3ez8Nm19AqyYh25AZHz3FUp
1JuYymZbeoDeH5q65KZVG3nBhYoTK9YXjm
1PNM2L1bpJQWipuAhNuB7BZbaFLB3LCuju
19onjpqdUsssaFKJjwuAQGi2eS41vE19oi
1JQ15RHehtdnLAzMcVT9kU8qq868xFEUsS
1LVpMCURyEUdE8VfsGqhMvUYVrLzbkqYwf
1KMcDbd2wecP4Acoz9PiZXsBrJXHbyPyG6
1DZiXKhBFiKa1f6PTGCNMKSU1xoW3Edb7Z
174bEk62kr8dNgiduwHgVzeLgLQ38foEgZ
17cvmxcjTPSBsF1Wi2HfcGXnpLBSzbAs6p
1NoYvnedUqNshKPZvSayfk8YTQYvoB2wBc
13694eCkAtBRkip8XdPQ8ga99KEzyRnU6a
TB9emsCq6fQw6wRk4HBxxNnU6Hwt1DnV67
TSfbXqswodrpw8UBthPTRRcLrqWpnWFY3y
TYVWbDbkapcKcvbMfdbbcuc3PE1kKefvDH
TNaeGxNujpgPgcfetYwCNAZF8BZjAQqutc
TJ1tNPVj7jLK2ds9JNq15Ln6GJV1xYrmWp
TGExvgwAyaqwcaJmtJzErXqfra66YjLThc
TC7K8qchM7YXZPdZrbUY7LQwZaahdTA5tG
TQuqKCAbowuQYEKB9aTnH5uK4hNvaxDCye
TFcXJysFgotDu6sJu4zZPAvr9xHCN7FAZp
TLDkM4GrUaA13PCHWhaMcGri7H8A8HR6zR
TPSLojAyTheudTRztqjhNic6rrrSLVkMAr
TY2Gs3RVwbmcUiDpxDhchPHF1CVsGxU1mo
TCYrFDXHBrQkqCPNcp6V2fETk7VoqjCNXw
TKcuWWdGYqPKe98xZCWkmhc1gKLdDYvJ2f
TP1ezNXDeyF4RsM3Bmjh4GTYfshf5hogRJ
TJcHbAGfavWSEQaTTLotG7RosS3iqV5WMb
TD5U7782gp7ceyrsKwekWFMWF9TjhC6DfP
TEu3zgthJE32jfY6bYMYGNC7BU2yEXVBgW
TK5r74dFyMwFSTaJF6dmc2pi7A1gjGTtJz
TBJH4pB4QPo96BRA7x6DghEv4iQqJBgKeW
TKBcydgFGX9q3ydaPtxht1TRAmcGybRozt
TQXoAYKPuzeD1X2c4KvQ4gXhEnya3AsYwC
TJCevwYQhzcSyPaVBTa15y4qNY2ZxkjwsZ
THpdx4MiWbXtgkPtsrsvUjHF5AB4u7mx3E
TWpCDiY8pZoY9dVknsy3U4mrAwVm8mCBh6
TK5zyFYoyAttoeaUeWGdpRof2qRBbPSV7L
TAzmtmytEibzixFSfNvqqHEKmMKiz9wUA9
TCgUwXe3VmLY81tKBrMUjFBr1qPnrEQFNK
TTPWAyW3Q8MovJvDYgysniq41gQnfRn21V
TWUJVezQta4zEX94RPmFHF2hzQBRmYiEdn
TPeKuzck7tZRXKh2GP1TyoePF4Rr1cuUAA
TJUQCnHifZMHEgJXSd8SLJdVAcRckHGnjt
TCgX32nkTwRkapNuekTdk1TByYGkkmcKhJ
TFDKvuw86wduSPZxWTHD9N1TqhXyy9nrAs
TQVpRbBzD1au3u8QZFzXMfVMpHRyrpemHL
TSE2VkcRnyiFB4xe8an9Bj1fb6ejsPxa9Z
THe32hBm9nXnzzi6YFqYo8LX77CMegX3v5
TXfcpZtbYfVtLdGPgdoLm6hDHtnrscvAFP
TXgVaHDaEyXSm1LoJEqFgKWTKQQ1jgeQr7
TD5cRTn9dxa4eodRWszGiKmU4pbpSFN87P
0xFc4a4858bafef54D1b1d7697bfb5c52F4c166976
0xa29eeFb3f21Dc8FA8bce065Db4f4354AA683c024
0x40C351B989113646bc4e9Dfe66AE66D24fE6Da7B
0x30F895a2C66030795131FB66CBaD6a1f91461731
0x57394449fE8Ee266Ead880D5588E43501cb84cC7
0xCd422cCC9f6e8f30FfD6F68C0710D3a7F24a026A
0x7C502F253124A88Bbb6a0Ad79D9BeD279d86E8f4
0xe86749d6728d8b02c1eaF12383c686A8544de26A
0xa4134741a64F882c751110D3E207C51d38f6c756
0xD4A340CeBe238F148034Bbc14478af59b1323d67
0xB00A433e1A5Fc40D825676e713E5E351416e6C26
0xd9Df4e4659B1321259182191B683acc86c577b0f
0x0a765FA154202E2105D7e37946caBB7C2475c76a
0xE291a6A58259f660E8965C2f0938097030Bf1767
0xe46e68f7856B26af1F9Ba941Bc9cd06F295eb06D
0xa7eec0c4911ff75AEd179c81258a348c40a36e53
0x3c6762469ea04c9586907F155A35f648572A0C3E
0x322FE72E1Eb64F6d16E6FCd3d45a376efD4bC6b2
0x51Bb31a441531d34210a4B35114D8EF3E57aB727
0x314d5070DB6940C8dedf1da4c03501a3AcEE21E1
0x75023D76D6cBf88ACeAA83447C466A9bBB0c5966
0x1914F36c62b381856D1F9Dc524f1B167e0798e5E
0xB9e9cfd931647192036197881A9082cD2D83589C
0xE88ae1ae3947B6646e2c0b181da75CE3601287A4
0x0D83F2770B5bDC0ccd9F09728B3eBF195cf890e2
0xe2D5C35bf44881E37d7183DA2143Ee5A84Cd4c68
0xd21E6Dd2Ef006FFAe9Be8d8b0cdf7a667B30806d
0x93Ff376B931B92aF91241aAf257d708B62D62F4C
0x5C068df7139aD2Dedb840ceC95C384F25b443275
0x70D24a9989D17a537C36f2FB6d8198CC26c1c277
0x0ae487200606DEfdbCEF1A50C003604a36C68E64
0xc5588A6DEC3889AAD85b9673621a71fFcf7E6B56
0x3c23bA2Db94E6aE11DBf9cD2DA5297A09d7EC673
0x5B5cA7d3089D3B3C6393C0B79cDF371Ec93a3fd3
0x4Cb4c0E7057829c378Eb7A9b174B004873b9D769
0xd299f05D1504D0B98B1D6D3c282412FD4Df96109
0x241689F750fCE4A974C953adBECe0673Dc4956E0
0xBc5f75053Ae3a8F2B9CF9495845038554dDFb261
0x5651dbb7838146fCF5135A65005946625A2685c8
0x5c9D146b48f664f2bB4796f2Bb0279a6438C38b1
0xd2Bf42514d35952Abf2082aAA0ddBBEf65a00BA3
0xbB1EC85a7d0aa6Cd5ad7E7832F0b4c8659c44cc9
0x013285c02ab81246F1D68699613447CE4B2B4ACC
0x97A00E100BA7bA0a006B2A9A40f6A0d80869Ac9e
0x4Bf0C0630A562eE973CE964a7d215D98ea115693
0x805aa8adb8440aEA21fDc8f2348f8Db99ea86Efb
0xae9935793835D5fCF8660e0D45bA35648e3CD463
0xB051C0b7dCc22ab6289Adf7a2DcEaA7c35eB3027
0xf7a82C48Edf9db4FBe6f10953d4D889A5bA6780D
0x06de68F310a86B10746a4e35cD50a7B7C8663b8d
0x51f3C0fCacF7d042605ABBE0ad61D6fabC4E1F54
0x49BCc441AEA6Cd7bC5989685C917DC9fb58289Cf
0x7fD999f778c1867eDa9A4026fE7D4BbB33A45272
0xe8749d2347472AD1547E1c6436F267F0EdD725Cb
0x2B471975ac4E4e29D110e43EBf9fBBc4aEBc8221
0x02004fE6c250F008981d8Fc8F9C408cEfD679Ec3
0xC4A51031A7d17bB6D02D52127D2774A942987D39
0xa1b94fC12c0153D3fb5d60ED500AcEC430259751
0xdedda1A02D79c3ba5fDf28C161382b1A7bA05223
0xE55f51991C8D01Fb5a99B508CC39B8a04dcF9D04
LNFWHeiSjb4QB4iSHMEvaZ8caPwtz4t6Ug
LQk8CEPMP4tq3mc8nQpsZ1QtBmYbhg8UGR
LMAJo7CV5F5scxJsFW67UsY2RichJFfpP6
LUvPb1VhwsriAm3ni77i3otND2aYLZ8fHz
LhWPifqaGho696hFVGTR1KmzKJ8ps7ctFa
LZZPvXLt4BtMzEgddYnHpUWjDjeD61r5aQ
LQfKhNis7ZKPRW6H3prbXz1FJd29b3jsmT
LSihmvTbmQ9WZmq6Rjn35SKLUdBiDzcLBB
Ldbnww88JPAP1AUXiDtLyeZg9v1tuvhHBP
LR3YwMqnwLt4Qdn6Ydz8bRFEeXvpbNZUvA
Lbco8vJ56o1mre6AVU6cF7JjDDscnYHXLP
LfqFuc3sLafGxWE8vdntZT4M9NKq6Be9ox
LLcmXxj8Zstje6KqgYb11Ephj8bGdyF1vP
LcJwR1WvVRsnxoe1A66pCzeXicuroDP6L6
LUNKimRyxBVXLf9gp3FZo2iVp6D3yyzJLJ
LY1NnVbdywTNmq45DYdhssrVENZKv7Sk8H
LNmMqhqpyDwb1zzZReuA8aVUxkZSc4Ztqq
LdxgXRnXToLMBML2KpgGkdDwJSTM6sbiPE
LZMn8hLZ2kVjejmDZiSJzJhHZjuHq8Ekmr
LVnc1MLGDGKs2bmpNAH7zcHV51MJkGsuG9
LRSZUeQb48cGojUrVsZr9eERjw4K1zAoyC
LQpGaw3af1DQiKUkGYEx18jLZeS9xHyP9v
LiVzsiWfCCkW2kvHeMBdawWp9TE8uPgi6V
LY32ncFBjQXhgCkgTAd2LreFv3JZNTpMvR
LdPtx4xqmA4HRQCm3bQ9PLEneMWLdkdmqg
LYcHJk7r9gRbg2z3hz9GGj91Po6TaXDK3k
LMhCVFq5fTmrwQyzgfp2MkhrgADRAVCGsk
LPv1wSygi4vPp9UeW6EfWwepEeMFHgALmN
Lf55UbTiSTjnuQ8uWzUBtzghztezEfSLvT
LdJHZeBQovSYbW1Lei6CzGAY4d3mUxbNKs
LbBxnFaR1bZVN2CquNDXGe1xCuu9vUBAQw
LWWWPK2SZZKB3Nu8pHyq2yPscVKvex5v2X
LYN4ESQuJ1TbPxQdRYNrghznN8mQt8WDJU
LiLzQs4KU79R5AUn9jJNd7EziNE7r32Dqq
LeqNtT4aDY9oM1G5gAWWvB8B39iUobThhe
LfUdSVrimg54iU7MhXFxpUTPkEgFJonHPV
LTyhWRAeCRcUC9Wd3zkmjz3AhgX6J18kxZ
Lc2LtsEJmPYay1oj7v8xj16mSV15BwHtGu
LVsGi1QVXucA6v9xsjwaAL8WYb7axdekAK
LewV6Gagn52Sk8hzPHRSbBjUpiNAdqmB9z
5VVyuV5K6c2gMq1zVeQUFAmo8shPZH28MJCVzccrsZG6
98EWM95ct8tBYWroCxXYN9vCgN7NTcR6nUsvCx1mEdLZ
Gs7z9TTJwAKyxN4G3YWPFfDmnUo3ofu8q2QSWfdxtNUt
CTgjc8kegnVqvtVbGZfpP5RHLKnRNikArUYFpVHNebEN
7Nnjyhwsp8ia2W4P37iWAjpRao3Bj9tVZBZRTbBpwXWU
3KFBge3yEg793VqVV1P6fxV7gC9CShh55zmoMcGUNu49
9eU7SkkFGWvDoqSZLqoFJ9kRqJXDQYcEvSiJXyThCWGV
4SxDspwwkviwR3evbZHrPa3Rw13kBr51Nxv86mECyXUF
4SxDspwwkviwR3evbZHrPa3Rw13kBr51Nxv86mECyXUF
9dtS7zbZD2tK7oaMUj78MKvgUWHbRVLQ95bxnpsCaCLL
7mdCoRPc1omTiZdYY2xG81EvGwN7Z2yodUTX9ZmLm3fx
8rdABs8nC2jTwVhR9axWW7WMbGZxW7JUzNV5pRF8KvQv
55YtaEqYEUM7ASAZ9XmVdSBNy6F7r5zkdLsJFv2ZPtAx
Gr8Kcyt8UVRF1Pux7YHiK32Spm7cmnFVL6hd7LSLHqoB
9MRmVsciWKDvwwTaZQCK2NvJE2SeVU8W6EGFmukHTRaB
5j4k1Ye12dXiFMLSJpD7gFrLbv4QcUrRoKHsgo32kRFr
F1SEspGoVLhqJTCFQEutTcKDubw44uKnqWc2ydz4iXtv
G3UBJBY69FpDbwyKhZ8Sf4YULLTtHBtJUvSX4GpbTGQn
DZyZzbGfdMy5GTyn2ah2PDJu8LEoKPq9EhAkFRQ1Fn6K
HvygSvLTXPK4fvR17zhjEh57kmb85oJuvcQcEgTnrced
bitcoincash:qpwsaxghtvt6phm53vfdj0s6mj4l7h24dgkuxeanyh
bitcoincash:qq7dr7gu8tma7mvpftq4ee2xnhaczqk9myqnk6v4c9
bitcoincash:qpgf3zrw4taxtvj87y5lcaku77qdhq7kqgdga5u6jz
bitcoincash:qrkrnnc5kacavf5pl4n4hraazdezdrq08ssmxsrdsf
bitcoincash:qqdepnkh89dmfxyp4naluvhlc3ynej239sdu760y39
bitcoincash:qqul8wuxs4ec8u4d6arkvetdmdh4ppwr0ggycetq97
bitcoincash:qq0enkj6n4mffln7w9z6u8vu2mef47jwlcvcx5f823
bitcoincash:qrc620lztlxv9elhj5qzvmf2cxhe7egup5few7tcd3
bitcoincash:qrf3urqnjl4gergxe45ttztjymc8dzqyp54wsddp64
bitcoincash:qr7mkujcr9c38ddfn2ke2a0sagk52tllesderfrue8
bitcoincash:qqgjn9yqtud5mle3e7zhmagtcap9jdmcg509q56ynt
bitcoincash:qpuq8uc9ydxszny5q0j4actg30he6uhffvvy0dl7er
bitcoincash:qz0640hjl2m3n2ca26rknljpr55gyd9pjq89g6xhrz
bitcoincash:qq0j6vl2ls2g8kkhkvpcfyjxns5zq03llgsqdnzl4s
bitcoincash:qq8m8rkl29tcyqq8usfruejnvx27zxlpu52mc9spz7
bitcoincash:qpudgp66jjj8k9zec4na3690tvu8ksq4fq8ycpjzed
bitcoincash:qqe3qc9uk08kxnng0cznu9xqqluwfyemxym7w2e3xw
bitcoincash:qpukdxh30d8dtj552q2jet0pqvcvt64gfujaz8h9sa
bitcoincash:qqs4grdq56y5nnamu5d8tk450kzul3aulyz8u66mjc
bitcoincash:qp7rhhk0gcusyj9fvl2ftr06ftt0pt8wgumd8ytssd
bitcoincash:qpmc3y5y2v7h3x3sgdg7npau034fsggwfczvuqtprl
bitcoincash:qzum0qk4kpauy8ljspmkc5rjxe5mgam5xg7xl5uq2g
bitcoincash:qqjqp8ayuky5hq4kgrarpu40eq6xjrneuurc43v9lf
bitcoincash:qqxu6a3f0240v0mwzhspm5zeneeyecggvufgz82w7u
bitcoincash:qpux2mtlpd03d8zxyc7nsrk8knarnjxxts2fjpzeck
bitcoincash:qpcgcrjry0excx80zp8hn9vsn4cnmk57vylwa5mtz3
bitcoincash:qpjj6prm5menjatrmqaqx0h3zkuhdkfy75uauxz2sj
bitcoincash:qp79qg7np9mvr4mg78vz8vnx0xn8hlkp7sk0g86064
bitcoincash:qr27clvagvzra5z7sfxxrwmjxy026vltucdkhrsvc7
bitcoincash:qrsypfz3lqt8xtf8ej5ftrqyhln577me6v640uew8j
bitcoincash:qrzfrff4czjn6ku0tn2u3cxk7y267enfqvx6zva5w6
bitcoincash:qr7exs4az754aknl3r5gp9scn74dzjkcrgql3jpv59
bitcoincash:qq35fzg00mzcmwtag9grmwljvpuy5jm8kuzfs24jhu
bitcoincash:qra5zfn74m7l85rl4r6wptzpnt2p22h7552swkpa7l
bitcoincash:qzqllr0fsh9fgfvdhmafx32a0ddtkt52evnqd7w7h7
bitcoincash:qpjdcwld84wtd5lk00x8t7qp4eu3y0xhnsjjfgrs7q
bitcoincash:qrgpm5y229xs46wsx9h9mlftedmsm4xjlu98jffmg3
bitcoincash:qpjl9lkjjp4s6u654k3rz06rhqcap849jg8uwqmaad
bitcoincash:qra5uwzgh8qus07v3srw5q0e8vrx5872k5cxguu3h5
bitcoincash:qz6239jkqf9qpl2axk6vclsx3gdt8cy4z5rag98u2r