Glossary / Privacy & security
Supply chain attack
- Definition
- A supply chain attack reaches you through something you already trust: the wallet update you installed, the code library inside it, or the device a reseller shipped.
There is no moment where you make a mistake, which is what makes this category hard to defend against. In November 2018 a widely used npm package called event-stream was handed to a volunteer maintainer who added code aimed squarely at one bitcoin wallet, Copay, and specifically at seeds controlling more than 100 bitcoin. Buying direct and verifying what you install are the two habits that genuinely help.
How it works
A supply chain attack inserts hostile code or hardware upstream of the victim, at a point where trust has already been granted.
The dependency. Modern wallet software pulls in hundreds of third-party packages. In the event-stream case the original author, tired of maintaining it, transferred publishing rights to a stranger who volunteered. The new maintainer added an innocuous-looking dependency, then published a version whose payload activated only inside builds of BitPay's Copay wallet, decrypted the seed, and sent it away. Copay releases 5.0.2 through 5.1.0 shipped with it.
The distribution channel. On December 14, 2023 a former Ledger employee's npm account was phished and used to publish malicious versions of Ledger's Connect Kit library. For several hours, applications that loaded it from a content delivery network served users a wallet drainer that redirected transfers. Roughly 600,000 dollars was taken from people who had opened a familiar site and clicked nothing unusual.
The hardware. Counterfeit or pre-seeded devices sold through marketplace listings and third-party resellers. The tell is simple and absolute: a genuine hardware wallet generates its recovery words on the device itself, at setup, once. Anything that arrives with words already printed on a card, or with instructions to enter a phrase supplied in the box, is a theft kit with good packaging.
The build. The defence here is reproducibility. Bitcoin Core has used Guix for bootstrappable, deterministic builds since version 22.0 in September 2021, so independent contributors compile the release from source and sign the result. If their attestations agree, the binary on the download page is the one the published source produces, and a compromised build machine cannot hide.
Where you see it
Four places in a normal bitcoin setup sit downstream of somebody else's trust decision.
Software downloads. Fetch installers from a page you navigated to yourself, then check the release signature, or at least the hash, against the project's own signing keys. Wallet projects publish both precisely so this step is possible.
Browser extensions. Extensions update themselves silently and change ownership quietly, so one that touches keys or addresses deserves the suspicion you would give an unsigned executable.
Hardware purchases. Buy from the manufacturer's own store or a named authorised reseller, never from a marketplace listing, an auction, or a secondhand seller. The hardware wallet reviews on this site link the official store for each device for exactly this reason.
Firmware and updates. Update through the vendor's own application, initiated by you, and never from a link in an email or a popup claiming your device is at risk.
Behind all four sits the control that limits the damage when one of them fails: confirm the destination address and the amount on the hardware wallet's own screen before approving. A compromised computer can rewrite anything it displays, but it cannot rewrite what a separate device shows you.
Supply chain attack vs clipboard malware
Clipboard malware is a payload; a supply chain attack is a delivery route, and the two get named as if they were alternatives. Address-swapping malware usually arrives because something was downloaded from the wrong place, so ordinary caution about sources works against it. A supply chain attack arrives inside something downloaded from exactly the right place, so caution about sources does not. What defeats both is the same habit, which is why it outranks knowing where any given piece of code came from: verify the address on the signing device, not on the screen that asked you to sign.