A domain hijacking attack on the Linux platform Snap Store has compromised wallet applications, leading to the theft of cryptocurrency assets. According to 23pds, Chief Information Security Officer of SlowMist, hackers executed a "domain resurrection attack" by taking over expired developer domains. They updated legitimate applications like Exodus, Ledger Live, and Trust Wallet through official channels, tricking users into entering mnemonic phrases and stealing their encrypted assets. Confirmed hijacked domains include storewise.tech and vacuumentertainment.com, exploiting the Snap mechanism to implant malicious code into trusted software.