Technical Definition

Supply Chain Attack

A supply chain attack compromises software, dependencies, updates, infrastructure, or vendors used by a crypto project or wallet.

By Crypto University Editorial
PhishingWallet DrainerPrivate Key

✦ Key Insight

Recognizing Supply Chain Attack can help users detect suspicious requests earlier and avoid signing, approving, installing, or paying into an attacker-controlled flow.

✕ Common Misconceptions

Do not rely on branding, screenshots, caller identity, transaction previews, or search results alone. Verify official domains, contract addresses, permissions, and wallet prompts independently.

Detailed Explanation

A supply chain attack compromises software, dependencies, updates, infrastructure, or vendors used by a crypto project or wallet. Attackers may combine this technique with phishing, malware, stolen credentials, or misleading wallet prompts.

In Practice

“A user encounters signs of Supply Chain Attack when a website, wallet prompt, support message, software update, or smart-contract interaction behaves unexpectedly.”

Dig Deeper

Smart Contract

A smart contract is self-executing code stored on a blockchain that automatically performs actions when certain conditions are met.

Private Key

A private key is a secret cryptographic code that proves ownership of crypto assets and allows the holder to authorize transactions.

Phishing

Phishing is a scam where attackers trick users into revealing private information or signing harmful transactions.

Token Approval

A token approval is an on-chain permission that a wallet owner grants to a smart contract, allowing that contract to transfer a specified (or unlimited) amount of a particular token (usually ERC-20) from the owner’s address.

Wallet Drainer

A wallet drainer is a malicious smart-contract or phishing toolkit designed to trick users into signing transactions or approvals that immediately (or later) transfer all valuable assets out of their wallet to the attacker’s address.