Supply Chain Attack

A supply chain attack is a cyberattack in which criminals or state-backed hackers break into a trusted third party, such as a software vendor, an open-source software library, a hardware maker or an IT service provider, and use that access to reach its customers. Instead of attacking a well-defended target directly, the attacker plants malicious code or steals credentials somewhere upstream, and the victims install or trust the tainted product because it comes from a familiar source.

The technique has become one of the most serious concerns in cybersecurity because one breach can spread to thousands of organizations at once. It overlaps with third-party risk and vendor risk management in finance, where banks and payment firms depend on outside software and cloud services. Crypto is especially exposed, since wallets, exchanges and decentralized applications rely heavily on shared code and a single malicious change can redirect funds.

Imagine a well-guarded office building. Burglars cannot get past the front desk, so instead they bribe the company that delivers the office's sealed water bottles and hide something inside the next delivery. Staff accept the bottles without question because they come from the usual supplier.

A supply chain attack works the same way with software. Modern apps are assembled from many pieces made by other people: code libraries, update services, plug-ins, cloud tools. If an attacker can tamper with any one of those pieces, the poisoned version is carried into every product and company that uses it, often through a normal-looking update. Victims do nothing wrong except trust a supplier.

Attackers use several routes into the chain:

• Compromised updates. Hackers break into a vendor's build system and insert malicious code into an official update, which customers then install, often with a valid digital signature.
• Poisoned open-source packages. They take over a maintainer's account, often through spear phishing, or offer to help maintain an abandoned project, then publish a malicious version of a widely used package.
• Look-alike packages. They publish packages with names similar to popular ones, relying on typosquatting or confusion between internal and public package names.
• Service providers. They breach managed IT or cloud providers that have remote access to many clients.
• Hardware and front ends. They tamper with devices before delivery, or with the web front end or browser scripts that users load to reach a service.

The planted malware may steal data, open a hidden backdoor, encrypt systems for ransomware or, in crypto, swap wallet addresses and drain funds.

In the SolarWinds attack, discovered in December 2020, hackers inserted a backdoor into updates of the company's Orion network-monitoring software, which reached thousands of customers including US government agencies. In 2017 the NotPetya malware spread through a hijacked update to Ukrainian accounting software and caused billions of dollars in damage to companies worldwide. In 2024 a developer discovered a backdoor deliberately planted over a long period in xz Utils, a compression tool found in many Linux systems, shortly before it reached widespread use; the case highlighted how few people sometimes maintain critical open-source code.

Crypto has its own examples. In 2018 a malicious update to the event-stream package for JavaScript was found to target the Copay bitcoin wallet. In December 2023 a compromised release of Ledger's Connect Kit library caused many decentralized applications to display a wallet-draining prompt for a few hours. In February 2025 the exchange Bybit lost about 1.5 billion US dollars in ether after attackers, attributed by the FBI to North Korea, compromised a developer machine at the provider of its multi-signature wallet interface and altered the transaction shown to Bybit's signers.

Crypto applications are built quickly on top of large numbers of shared packages, browser extensions and hosted front ends, and transactions are irreversible. An attacker who manages to change a single line, such as the address funds are sent to, can steal assets in minutes, and stolen coins are quickly moved through mixers and bridges. Even users with hardware wallets can be fooled if the screen they rely on shows a doctored transaction, which is why security teams urge signers to verify what they approve independently.

No single measure stops supply chain attacks, but organizations combine several:

• Knowing what is used. A software bill of materials lists every component in a product, so affected systems can be found quickly when a flaw is announced.
• Locking versions. Pinning dependencies to reviewed versions, and checking changes before upgrading, prevents a malicious new release from being pulled in automatically.
• Securing build systems. Vendors protect signing keys, require multi-factor authentication for maintainers and make builds reproducible so outputs can be checked.
• Limiting access. Suppliers receive only the permissions they need, and their activity is monitored.
• Independent review. Code audits, a smart contract audit for on-chain code, and bug bounties encourage problems to be found before attackers exploit them.

Regulators increasingly expect firms to manage these risks. The European Union's Digital Operational Resilience Act, which applies to financial entities from January 2025, includes rules on oversight of information technology providers, and US federal agencies have issued guidance on secure software development.

• Cybersecurity and Infrastructure Security Agency
• UK National Cyber Security Centre