What is a supply chain attack in crypto?

A supply chain attack in crypto is an attack on the path a product takes to reach you. Rather than hacking a single wallet, the attacker alters software or hardware somewhere upstream, so everyone who installs that code or unboxes that device inherits the problem. These attacks matter because they abuse trust in a known brand.

How do software supply chain attacks work?

Most apps are built from shared code packages. If an attacker can publish a bad version of a popular package, every app that loads it can be affected at once. Ledger's report on the December 14, 2023 Connect Kit incident shows how this plays out. An attacker phished a former Ledger employee, whose access to the npm package registry had not been revoked, and published malicious versions of the Connect Kit library. Apps that used the library showed users fake transaction requests that drained their wallets once signed.

Ledger said it deployed a fixed version within 40 minutes of becoming aware, but because of caching on content delivery networks, about five hours passed from the compromise to full resolution. The damage came from users signing what the apps showed them, which is the same trap described in crypto phishing and wallet drainers.

What is a hardware wallet supply chain attack?

A hardware attack changes the physical device before the buyer gets it. Trezor wrote on October 30, 2026 that Ledger began investigating losses among customers of CryptoBilis, then an authorized reseller in Southeast Asia, on October 9, and later confirmed some devices had been physically tampered with. Trezor removed CryptoBilis from its reseller network the same day.

Trezor then received a report of an implant in a Trezor Safe 5 bought from CryptoBilis. It said it had not yet examined the device but treated the report as credible, and told anyone who bought a Trezor from CryptoBilis from March 2026 onward to move funds to a newly created wallet with a new recovery phrase. Trezor said no CryptoBilis buyer had reported a loss to it.

How can you reduce supply chain risk?

Hardware makers point buyers to their own stores and authorized resellers, and Ledger says buying through those channels is safer when combined with its Genuine Check. Background on device makers is in is Ledger safe and is Trezor safe. A genuine device should never arrive with a recovery phrase already written down.

For software, the main protection on the user side is reading what a wallet asks you to sign, and treating unexpected approval requests with suspicion even on a familiar site.

Details of these incidents are as reported by the companies at the time and may change as investigations continue.