Supply-Chain Attacks: Malicious Packages and Compromised Wallet Libraries

A crypto supply chain attack is when criminals compromise software that wallets, apps or websites depend on, such as an open-source package, a browser extension or an update server, so that malicious code reaches users through a trusted channel. The code typically swaps destination addresses, injects a wallet drainer into a website or steals seed phrases, and victims often do nothing wrong except use a product they already trust.

These attacks matter to everyone in crypto, not only developers. Modern wallets and decentralized apps are built from hundreds of third-party components, and one compromised component can affect many products at once. This guide explains how the attacks work, what to look out for and how to reduce your exposure as a user or builder.

How a Supply Chain Attack Works

The "supply chain" of a crypto app is everything that goes into it: code libraries, build tools, hosting providers, content delivery networks and update servers. An attack typically follows these steps:

1. 1Gain access. The attacker phishes a maintainer of a popular library, buys an abandoned package, guesses a weak password or exploits a build server.
2. 2Insert malicious code. They publish a new version containing hidden code, often obfuscated and designed to activate only in certain conditions, such as when a crypto wallet is present.
3. 3Spread through updates. Apps that automatically pull the latest version of the library include the malicious code in their next build or, for websites, as soon as the script loads.
4. 4Steal. The code might replace addresses copied to the clipboard, show a fake transaction prompt, request a seed phrase or inject a drainer into a decentralized app's front end.
5. 5Hide. Attackers often remove the code quickly after use, making investigation harder.

There are documented real incidents of this pattern. In 2018, a malicious dependency added to a popular JavaScript package was designed to steal from users of a specific bitcoin wallet app. In December 2023, a compromised version of Ledger's Connect Kit library briefly caused several decentralized apps to show a wallet drainer to their users. Both cases show that the weak point was the shared code, not the users. For a deeper look, see Vanity Address Risks and Look-Alike Addresses.

Common Entry Points

Typosquatting, uploading a package with a name very close to a popular one, is especially common. A developer who mistypes a package name can install malware without noticing.

A Hypothetical Example

This is an illustrative composite, not a real case. Imagine a small decentralized exchange that loads a popular wallet-connection library from a public package registry. One morning, the library's maintainer is phished and the attacker publishes a new version. The exchange's website loads the latest version automatically.

For a few hours, every user who connects a wallet sees what looks like a normal swap prompt. In reality, it is a request to approve their tokens to the attacker's contract. Users who carefully read their wallet's approval screen notice an unfamiliar contract and stop. Users who click through lose their tokens. The exchange team discovers the problem when users report losses and publishes an alert, but by then the code has already been removed.

Warning Signs for Users

• A familiar app suddenly asks for a seed phrase or a "wallet validation" step it never asked for before.
• A routine action produces an unusual wallet prompt, such as an unlimited approval or a signature for an unknown contract.
• The address shown on your hardware wallet screen does not match the one you intended.
• A browser extension updates and requests new permissions, especially to read and change data on all websites.
• A project or security researchers post urgent warnings not to use a site or app.

Many of these overlap with clipboard malware and fake wallet apps, which use similar techniques. See also: Fake Browser Update and Captcha Malware Targeting Crypto Users.

How to Protect Yourself

As a User

1. 1Use a hardware wallet and read the address, amount and contract on its screen before confirming.
2. 2Keep extensions minimal. Remove ones you don't use, and be cautious when an extension changes owner or asks for new permissions.
3. 3Separate funds. Keep long-term holdings in a wallet that rarely connects to websites, and use a different wallet for everyday DeFi.
4. 4Pause after security alerts. Avoid using an app until it confirms the issue is fixed.
5. 5Revoke unneeded approvals periodically.

As a Developer or Project

• Pin dependency versions and use lockfiles; review changes before upgrading.
• Check package names carefully and prefer well-maintained libraries.
• Require multi-factor authentication for package registry and code hosting accounts.
• Use signed releases and, where possible, reproducible builds so users can verify binaries.
• Use a content security policy and subresource integrity for third-party scripts.

What to Do If You Were Affected

1. 1Stop using the affected app or extension and disconnect any wallets.
2. 2Check your transaction history for approvals or transfers during the affected period.
3. 3Revoke any suspicious approvals and move remaining funds to a new wallet with a new seed phrase if your seed phrase may have been exposed.
4. 4Collect transaction hashes and addresses, then report the incident through the project's official channels and our scam report form.

Follow the full checklist in what to do immediately if your wallet is compromised.

Bottom line

Supply chain attacks turn trusted software into a delivery channel for theft, so you cannot rely only on avoiding suspicious links. Treat your hardware wallet screen and wallet prompts as the final check, keep your software footprint small and react quickly to official security alerts. Builders carry most of the responsibility: pin, review and sign everything you ship.