What Is a Supply Chain Attack and How Can Crypto Businesses Defend Against It?

A supply chain attack is one where the attacker does not go after the target business directly. Instead, they first compromise a third party the business depends on, such as an open-source library, a software vendor, a cloud service or a front-end component, and then use that trusted channel to deliver malicious code inside. For crypto businesses, the key to defense is making sure no single third-party component can decide a transfer: manage dependencies strictly, isolate the signing environment, and use independent rules and approvals to check the transaction again before it is signed.

How Do Supply Chain Attacks Happen?

Modern systems are rarely built entirely in-house. A wallet back end may depend on hundreds of open-source packages and connect to cloud services, monitoring tools, security software and external SDKs. An attacker only needs to break one link: hijack an open-source maintainer’s account and publish a malicious new version, break into a vendor’s build system and plant a backdoor in an update, or tamper with a front-end script that a web page loads from a CDN. When the business updates or uses these components as usual, the malicious code comes in with them, carrying a trusted signature and source.

What Are Typical Supply Chain Attacks in the Crypto Industry?

The most notable example is the roughly $1.5 billion theft from Bybit in February 2025. The attackers did not break into Bybit’s own systems. They compromised the development environment of the multisig wallet provider Bybit used and planted a malicious script in its web interface. Signers saw what looked like a normal transfer on screen, but what they actually signed was a transaction that changed the wallet contract. Earlier, in late 2023, a widely used wallet connection library was also tampered with, leading to thefts from many DApp users. None of these attacks broke the cryptography. They exploited the trust businesses place in third parties, which is why they are among the hardest to stop of all the ways crypto wallets can be hacked.

Why Are Supply Chain Attacks So Hard to Defend Against?

Because the malicious code arrives through channels the business already trusts. Firewalls and antivirus software will not block a normal software update, and engineers can hardly review every line of every dependency. More dangerous still, once malicious code gets into the signing flow, it can make what signers see on screen differ from what they actually sign. Even with multi-person approval in place, if every approver relies on the same tampered interface to judge a transaction, all of the approvals fail together.

How Can Crypto Businesses Defend Against Supply Chain Attacks?

The first step is managing dependencies: pin dependency versions, review updates before adopting them, cut unnecessary third-party components, and verify the integrity of build pipelines and release processes. The second is isolating the signing environment, so that devices used for approval and signing run no unrelated software and are not shared with everyday office work. The third is making sure no single interface decides a transaction. A server-side policy engine should independently parse and check each transaction before signing, blocking anything that goes to an address outside the address whitelist, exceeds a limit or calls an unknown contract, while approvers verify the full transaction details on a separate device. Combined with an MPC wallet that removes the complete private key, even if one component is compromised, an attacker will find it very hard to move funds alone.

Conclusion

Supply chain attacks exploit the trust businesses place in third parties, and they are hard to rule out at the source. Managing dependencies, isolating the signing environment, and adding one more independent checkpoint before signing with rules, whitelists and MPC keep a single compromised component from turning directly into lost assets. Safeheron’s Wallet-as-a-Service provides businesses with MPC key management and a policy engine.

Want to assess whether your wallet system has supply chain risk? Contact Safeheron’s Sales Team to Book a 1:1 Demo