A serious vulnerability in the EngageLab SDK has put 30 million crypto wallet users at risk.

EngageLab SDK Vulnerability Puts 50M Android Users at Risk, Including 30M Crypto Wallet Users

A serious security flaw has been found in the EngageLab SDK, a widely used Android push notification tool. The vulnerability affects over 50 million Android users, including roughly 30 million crypto wallet users.

Attackers can install a malicious app disguised as a legitimate one on a victim's device, then send harmful intents to other apps that have integrated the EngageLab SDK. This can lead to unauthorized access, theft of private keys, and stolen login credentials. GoPlus recommends that developers and app vendors upgrade to version 4.5.5 or later. Regular users should immediately update any affected Android apps—especially crypto wallets and financial apps.