Crypto and gaming apps built with Unity are facing a security issue, as a vulnerability allows a malicious app already on devices to coerce a vulnerable Unity app into loading hostile code.
On desktop platforms, the risk centers on elevation of privilege. Unity says there’s no evidence of exploitation in the wild, but urges swift updates. The bug forces Unity’s runtime to accept specific pre-initialization arguments that influence where it searches for native libraries.
If an attacker can control that search path, the Unity app may load and execute the attacker’s library. Security firm GMO Flatt explained that the product trusts resources found on an external or attacker-influenced path.
Many Unity-built apps integrate wallet SDKs, custodial logins, or WalletConnect-style sessions. Code injected into that specific Unity app can read its private files, hijack its WebView, call the same signing APIs, or exfiltrate session tokens.
Although the code does not jump sandboxes to drain unrelated wallet apps, the vulnerable Unity app holds keys or can request signatures via Android Keystore. As a result, an attacker can piggyback permitted actions.
Unity’s own advisory stressed that impact is confined to the app’s privileges, exactly the permissions a game-embedded wallet would rely on.
To check if a device is affected, the first step is to check the apps’ store pages’ date. On Android, if a game or wallet-enabled app shows an update on or after Oct. 2, it is likely that the developer has rebuilt with a fixed Unity editor or applied Unity’s patch.
Keeping Play Protect enabled, avoiding sideloaded applications, and pruning suspicious apps are among the recommended practices to stay safe while waiting for updates.
For developers, it is recommended to check which Unity editor produced the Android build in use and compare it to Unity’s fixed versions table.
Patched versions include 6000.0.58f2 (Unity 6 LTS), 2022.3.67f2, and 2021.3.56f2. Unity also published the first fixed tags for out-of-support streams back to 2019.1. Any builds predating the versions described must be treated as exploit angles
Even after patching the issue, users should treat wallet-integrated flows defensively. Ensuring seed phrases are never stored in plaintext and enforcing biometric prompts for every transfer are good practices.
Additionally, users can leverage Android Keystore for keys that require explicit user confirmation for all signing operations.
Disconnecting any lingering WalletConnect sessions and keeping larger balances on a hardware wallet until developers confirm the patched Unity build is live is a helpful extra step. These measures reduce the blast radius, even if a future path-loading bug were to be discovered.
Although CVE-2025-59489 is serious, it has well-defined fixes and clear operating guidance that users and developers can follow to stay safe.
