Supply Chain Attack (Crypto)
An attack that compromises a trusted piece of software (such as a library, package, or browser extension) rather than directly targeting the end user.
A supply chain attack compromises a trusted piece of software — such as a code library, package dependency, or browser extension — that many other applications or users rely on, rather than directly attacking any single end user, letting one successful compromise potentially affect every downstream user of the compromised software at once.
In crypto specifically, several real, well-documented incidents have involved a compromised wallet browser extension or a malicious code package silently stealing private keys or redirecting transactions, making verifying the specific source and version of wallet software a genuinely important practice, not an excessive precaution.
Examples
- A single compromised code package can silently affect every wallet application that depends on it, a key reason supply chain attacks are so consequential.
- Several real crypto supply chain attacks have involved a compromised browser extension silently stealing private keys from users who trusted it.