Crypto glossary
Supply chain attack
A supply chain attack compromises a library, tool, vendor or device that crypto apps depend on, so malicious code reaches users through a trusted channel.
Modern wallets and dApps are assembled from hundreds of third-party pieces: open-source packages from registries such as npm, wallet connection kits, analytics scripts, build servers, cloud services and hardware components. In a supply chain attack, the attacker does not break the target directly but poisons one of those pieces, often by phishing a maintainer or stealing a publishing token. Every project that pulls the tainted update then ships the malicious code.
Crypto has seen several cases. In December 2023 a compromised release of Ledger's Connect Kit library briefly injected a wallet drainer into dApps that used it. In September 2025 popular npm packages were hijacked with code that rewrote crypto transactions in browsers. The February 2025 Bybit theft, attributed to North Korea's Lazarus Group, began with a compromised developer machine at the multisig provider whose interface Bybit's signers used.
These attacks are hard to spot because the code arrives from a source everyone trusts. Defences include pinning and reviewing dependency versions, reproducible builds, signing releases, restricting who can publish, and wallets that show human-readable transaction details so a tampered interface is caught at signing time.
Example
Attackers phish the maintainer of a widely used JavaScript library and publish a version that swaps wallet addresses; within hours, dApps that auto-update their dependencies start serving it.
Related terms
Latest articles on Supply chain attack
- North Korean Hackers Suspected in Rust Supply Chain Attack Targeting Arrayref
- Injective Blocks npm Supply Chain Attack Before Impact, Confirms No Funds Were at Risk
- Fewer Breaches, Bigger Threat: Supply Chain Attacks Shake Crypto Security
- 1inch Hit by Supply Chain Attack! Users’ Funds and Data at Risk – Here’s What to Know