Coin responds to SparkKitty virus infection: Risky SDK was implanted, but related functions never took effect, user data is always safe

Odaily Planet Daily News: Securelist released a report today pointing out that "Coin" is suspected of being infected with a new malicious virus SparkKitty, which has attracted widespread attention in the market. In response, the Coin team issued a response, admitting that it had accessed a third-party SDK provided by the Bitdu exchange, but stated that the high-risk functions involving album permissions and picture uploads in the SDK were disabled from beginning to end, never activated or triggered, and user data was not affected in any way. According to Coin, Bitdu plans to acquire Coin in 2023 and requires access to its SDK for evaluating user activity. During the test, the Coin technical team found that the SDK had suspicious behavior of inducing the opening of album permissions and uploading photos, and then completely blocked the upload function through the interface to ensure that the potential risk function could not run. At present, Coin has launched a full code security review and promised to upgrade the third-party SDK review and partner background investigation process to prevent similar incidents from happening again.