Phishing Without a Lure: Crypto’s Supply-Chain Attacks in 2026

On the morning of September 8, 2025, a single phishing email did what no smart-contract bug had managed all year: it slipped hostile code into software that runs on a meaningful slice of the internet. The target was not a crypto trader or a DeFi treasury. It was a developer named Josh Junon, who maintains a cluster of small, unglamorous JavaScript packages, chalk, debug, ansi-styles, and more than a dozen others, that are downloaded together more than two billion times every week. Within about sixteen minutes of taking over his npm account, the attackers published poisoned versions of those packages, each carrying a crypto-draining payload built to rewrite wallet addresses inside the browser. Security vendor Aikido Security flagged the malicious releases, and The Hacker News called it one of the largest npm compromises on record.

Almost exactly a year later, that incident still offers the clearest picture we have of where crypto phishing is heading. There was no fake airdrop, no spoofed support account, no cloned login page. There was no lure at all. The malicious code travelled through the same trusted plumbing that legitimate software uses every day, and it would have reached victims on the very websites they had every reason to trust. This is supply-chain phishing, and it quietly inverts almost everything crypto users have been taught about staying safe.

A near-miss that rewrote the threat model

The mechanics of the September 2025 attack were almost boringly simple, which is what makes them frightening. Three days before the strike, on September 5, the attackers registered npmjs.help, a look-alike of the real npm support domain, and used it to send Junon a message warning that his account would be locked unless he verified his credentials. He entered them. With his publishing rights in hand, the attackers pushed tampered versions of at least eighteen packages (some tallies count twenty) into the registry. Individually these are tiny utilities. Collectively, chalk draws nearly 300 million weekly downloads, debug over 357 million, and ansi-styles more than 371 million, and they sit deep in the dependency trees of a huge share of the JavaScript world.

Ledger’s chief technology officer, Charles Guillemet, sounded the alarm within hours. As reported by The Block and CoinDesk, he warned that a large-scale supply chain attack was in progress, that the poisoned packages had already been downloaded more than a billion times, and that the payload “works by silently swapping crypto addresses on the fly to steal funds.” His advice was blunt: “If you use a hardware wallet, pay attention to every transaction before signing and you’re safe. If you don’t use a hardware wallet, refrain from making any on-chain transactions for now.” For a few hours, a meaningful portion of the crypto economy was told to simply stop transacting.

The malicious releases were live for roughly two hours before they were pulled. Junon, mortified, posted a public apology, admitting he “should have paid more attention” and had “had a stressful week.” The scare passed. But it left behind a lesson that the industry is still absorbing: the most dangerous phishing campaign of the year did not target a single user. It targeted the software that users run, and it reached them without any of them clicking a thing.

Phishing without a lure

Traditional phishing is a con built around misdirection. It needs to get the victim to a place they should not be: a cloned exchange login, a malicious link in a Discord DM, a fake wallet pop-up that harvests a seed phrase. Every anti-phishing habit we teach follows from that model. Check the URL. Do not click strange links. Bookmark the real site. Never type your recovery phrase into a website. Supply-chain phishing removes the misdirection entirely. Instead of luring the victim to a hostile place, the attacker poisons a component the victim already trusts, an npm package inside a dapp, the dapp’s own front-end code, a browser extension, or the DNS record that points a domain at a server, and lets the trust do the work.

Microsoft’s security researchers gave the on-chain version of this a name back in February 2022: ice phishing. In their write-up, they described a technique that “doesn’t involve stealing one’s private keys” but instead “entails tricking a user into signing a transaction that delegates approval of the user’s tokens to the attacker.” The victim never hands over a secret. They approve a transaction that looks legitimate precisely because it is being served by legitimate infrastructure. That is why supply-chain attacks belong squarely inside the phishing family even when no email is involved. The delivery vehicle changes, but the end state is identical: a user authorizing a transfer that drains their own wallet. The signature is still the exploit; only the channel that produced it is new.

The clipper in the browser

The technical heart of the npm attack was a piece of browser-side malware that security researchers call a clipper, and it is worth understanding in detail because it defines the whole category. Once a poisoned package loaded on a web page, the code checked for the presence of a crypto wallet, then hooked the browser’s plumbing: window.ethereum, the interface wallets like MetaMask expose, plus the raw fetch and XMLHttpRequest functions the page uses to talk to servers. From that vantage point it could watch every piece of data flowing in and out. When it spotted a cryptocurrency address, it swapped it for one the attackers controlled, using a nearest-match algorithm so the replacement address resembled the original. It targeted Ethereum, Bitcoin, Solana, Tron, Litecoin, and Bitcoin Cash alike.

Charlie Eriksen, the Aikido malware researcher who helped surface the campaign, described why that design is so dangerous. The code, he told BleepingComputer, “operates at multiple layers: altering content shown on websites, tampering with API calls, and manipulating what users’ apps believe they are signing.” That last clause is the crux. A careful user who copies an address and checks the first and last four characters on screen could see the correct address, while the transaction actually broadcast to the network carries the attacker’s. The display and the payload are decoupled. This is exactly the failure mode that blind signing enables and clear signing is meant to close: if you cannot independently read what you are authorizing on a trusted screen, a compromised web page can make you sign anything while showing you something else.

The strange arithmetic of a $500 heist

Here is the twist that makes the npm attack unforgettable: after compromising packages downloaded more than two billion times a week, the attackers stole almost nothing. The Security Alliance, the nonprofit incident-response collective known as SEAL, published a post-mortem wryly noting that the attacker appeared to have made off with around five cents of Ethereum and roughly twenty dollars of a memecoin. Socket’s own tally put the total wallet value closer to $600, most of it obscure tokens, and blockchain analytics firm Arkham pegged the attacker’s balance at about $505. By any accounting, the haul was under a thousand dollars.

Feross Aboukhadijeh, founder and chief executive of the supply-chain security firm Socket, captured the anticlimax on a security podcast, later published by his company. This was, by download count, probably the biggest supply chain attack in npm’s history, he said, and yet: “The attackers managed to snap up about $500 worth of Ethereum and maybe 50 bucks worth of some other miscellaneous cryptos.” For all that access, he added, the result was somewhat disappointing.

Why so little? Timing and luck. The malicious versions were caught within roughly two hours. The payload was buggy and, in Aikido’s assessment, carelessly executed. Most high-value crypto flows now route through hardware wallets with some form of transaction verification, and the code only worked against browser-based signing. But the counterfactual is the whole point. With two billion weekly downloads as a distribution channel and a cleaner payload that lingered for a day instead of two hours, the ceiling was enormous. SEAL’s samczsun argued that the real damage was never going to show up on-chain anyway: “the biggest financial impact of this entire incident will be the collective thousands of hours spent by engineering and security teams around the world working to clean compromised environments, and the millions of dollars of sales contracts that will inevitably be signed as a result of this new case study.” Guillemet, surveying the wreckage a day later, put it plainly to The Block: the immediate danger may have passed, but the threat had not.

When the phish learned to replicate

If the chalk and debug compromise was a warning, the weeks that followed were the escalation. On September 15, 2025, a self-propagating worm nicknamed Shai-Hulud began tearing through npm. Rather than steal crypto directly, it stole the keys to the kingdom: it ran the open-source secret scanner TruffleHog across infected machines to harvest npm tokens, GitHub credentials, and cloud keys, exfiltrated them to newly created public GitHub repositories, and then used the stolen npm tokens to publish copies of itself into up to twenty more packages owned by each compromised maintainer. It started with a package downloaded over two million times a week and spread from there. Security firms tracked the first wave from around forty poisoned packages to well over a hundred and eighty, with some counts exceeding five hundred. Even packages published by security vendor CrowdStrike were caught in the blast.

The worm returned in November 2025 in a larger, angrier form that researchers dubbed Shai-Hulud 2.0. Datadog’s security team counted 796 unique packages across more than a thousand versions, with the exfiltration repositories carrying the fixed description “Sha1-Hulud: The Second Coming.” Among the affected organizations were names familiar to crypto developers, including ENS Domains. A worm does not need a wallet-drainer of its own to threaten crypto. The credentials it harvests are exactly the access an attacker needs to publish the next drainer, which is how the chalk and debug campaign started in the first place.

A month before Shai-Hulud, in late August 2025, an attack on the popular Nx build system introduced an even stranger wrinkle. As documented by StepSecurity, the malware hunted for developers’ own AI command-line assistants, Claude, Gemini, and Amazon Q, and invoked them with their safety guardrails disabled to help scan for wallet files and secrets. StepSecurity called it the first known case where malware harnessed developer-facing AI CLI tools. The assistants did not always comply, and in some cases refused outright, but the intent was clear: the attackers were trying to turn the developer’s own machine, and the developer’s own AI, into an accomplice.

A short history of poisoned packages

None of this is truly new. The pattern of hijacking trusted code to steal crypto is nearly a decade old, and the through-line is remarkably consistent: compromise a maintainer or a package, insert a payload aimed at wallets, and let the ecosystem distribute it for you. The 2018 event-stream incident is the archetype. As The Hacker News reported at the time, an attacker volunteered to help maintain a widely used Node.js module, was handed publishing rights, and quietly added a dependency whose backdoor activated only inside BitPay’s Copay Bitcoin wallet, exfiltrating private keys from wallets holding more than 100 BTC. It went undetected for over two months.

The table below traces the lineage from that first surgical strike to the industrialized, sometimes state-sponsored campaigns of 2026. The amounts are almost beside the point; what matters is that the same technique keeps working.

Two entries deserve a closer look. The Ledger Connect Kit attack of December 2023 poisoned a software component that dozens of major dapps, including SushiSwap, Zapper, Balancer, and Revoke.cash, loaded into their front-ends. A former Ledger employee had been phished, and the tampered code injected a fake wallet-connection pop-up that drained users who approved it. Ledger patched the code within about forty minutes of discovery, though the malicious file lingered for roughly five hours because of caching, and ZachXBT estimated losses near $600,000. The December 2024 Solana web3.js compromise was narrower but sharper: malicious versions 1.95.6 and 1.95.7 of a core Solana library carried a function that smuggled private keys out inside network headers. Maintainer Steven Luscher stressed in the official advisory that it was “not an issue with the Solana protocol itself,” only the client library, and only for projects that directly handled private keys during the roughly five-hour window on December 3.

When the website itself lies

Poisoned packages are only half the story. The other half is what happens when the website you visit is genuine but the code it serves is not. This is the domain of DNS hijacking and front-end compromise, and for a self-custody user it is arguably scarier, because the address bar shows the correct URL the entire time. The canonical case is BadgerDAO, which lost roughly $120 million in late 2021 after attackers used a stolen Cloudflare API key to inject malicious JavaScript into the real badger.finance front-end. The script quietly inserted extra approval requests, and hundreds of users granted an attacker unlimited spending rights over their vault tokens. It was ice phishing at industrial scale, delivered through the project’s own website.

DNS hijacking achieves the same effect one layer lower. In August 2022, Curve Finance’s domain was hijacked when attackers compromised the nameserver at its registrar, iwantmyname, and repointed curve.fi to a cloned site running a wallet-drainer. Around $570,000 was siphoned before the redirect was caught. Curve was hit again in May 2025 by the same class of attack and eventually migrated to a new domain. The pattern recurs constantly: Balancer lost roughly a quarter of a million dollars to a EuroDNS social-engineering attack in 2023, and in July 2024 a botched migration from Google Domains to Squarespace let attackers hijack the domains of major DeFi projects including Compound and Celer, with an estimated 228 front-ends at risk, all pushing the Inferno Drainer kit.

The threat is not historical. In April 2026, DeFi aggregator CoW Swap warned users to stay away from its own site after its DNS was hijacked and its domain repointed to a drainer that requested unlimited spend approvals. The company halted trading while it regained control. For the user, every one of these attacks defeats the advice to bookmark the real site, because the bookmark still resolves to the hijacked domain.

The extension and the app you trusted

The trusted channel can also be the software you install on purpose. In mid-2025, researchers at Koi Security exposed a campaign they called FoxyWallet: more than forty malicious Firefox extensions that impersonated real wallets including MetaMask, Coinbase Wallet, Trust Wallet, Phantom, Exodus, OKX, and Keplr. The attackers cloned the genuine open-source extensions, added code to exfiltrate seed phrases and keys to their servers, and published them to the official add-ons store, where they behaved exactly as expected while quietly stealing. Russian-language artifacts in the code pointed to the actor behind them.

Developers are targeted too, and the payoff can be direct. In June 2025, Kaspersky documented a fake “Solidity Language” extension on the Open VSX marketplace used by the Cursor code editor. It typosquatted a legitimate publisher’s name, inflated its download count, and delivered a chain of remote-access malware that drained roughly $500,000 from a single blockchain developer. Kaspersky’s Georgy Kucherin observed that “spotting compromised open-source packages with the naked eye is becoming increasingly difficult.” Fresh variants keep appearing, including a family of “Solidity Pro” extensions flagged in August 2026 that harvest MetaMask, Phantom, Rabby, and other wallets.

Even the official app stores are not immune. In April 2026, on-chain investigator ZachXBT surfaced a counterfeit “Ledger Live” app that had slipped onto Apple’s App Store and drained roughly $9.5 million from more than fifty victims before Apple pulled it. The app looked legitimate, carried a plausible developer name, and asked users for their recovery phrase. Apple’s review process, the closest thing mobile has to a trusted gatekeeper, waved it through. For a fake app to net nearly twenty thousand times what the two-billion-download npm attack managed is a stark reminder that the size of the compromised channel and the size of the loss are only loosely related.

Why this beats the advice you were given

Line up the standard crypto safety checklist against supply-chain phishing and it collapses almost entirely. “Check the URL” fails, because the URL is real; the poison is in the DNS or the front-end behind it. “Use a bookmark” fails, because the bookmark points to the hijacked domain. “Only use official sites and official apps” fails, because the official site was compromised and the fake app is in the official store. “Verify the address before you send” fails, because the malware rewrites what you see on screen while altering what you sign. The entire mental model of phishing as something you can spot if you are careful enough does not survive contact with an attack that hides inside trusted infrastructure.

What survives is a smaller, harder set of defenses that assume the software around you may already be lying. The first is verifying transactions on a device the compromised page cannot touch, which in practice means a hardware wallet that shows you the real destination and amount on its own screen. The second is treating standing token approvals as a liability to be minimized, not a convenience. The third, for anyone who builds or self-hosts, is treating the dependency tree as attack surface. Our field guide to bridging crypto safely makes the same argument in a different context: the winning move is rarely to spot the scam in the moment, but to structure your setup so that a single compromised page or contract cannot reach everything you own.

How big is it, really?

Here is where supply-chain phishing gets genuinely counterintuitive. Measured by dollars stolen in the browser, it is small and often near-zero. Measured by blast radius and tail risk, it is the scariest category in crypto security, because a single clean success could be systemic. Both things are true at once, and the headline statistics can mislead if you only read one of them.

The good news first. According to Scam Sniffer’s 2025 annual report, on-chain wallet-drainer phishing losses fell about 83 percent to roughly $83.85 million, down from nearly $494 million the year before, with the number of victims dropping from around 332,000 to about 106,000. Early 2026 continued the slide. Better wallet warnings, transaction simulation, and the takedown of major drainer operations all bit into the numbers. But the wider fraud picture moved the other way. Chainalysis estimated total crypto scam revenue at around $17 billion in 2025, with impersonation scams up more than 1,400 percent year over year. The FBI’s 2024 Internet Crime Report tallied $9.3 billion in crypto-related losses in the United States alone. The money did not leave; it migrated toward higher-value, more targeted attacks, which is precisely the niche supply-chain compromise occupies.

CertiK’s Hack3D report for the first half of 2026 counted about $1.31 billion lost across 344 incidents, with wallet compromise and phishing again leading the categories. Supply-chain phishing rarely tops those charts by dollars stolen. Its danger is that it sits one lucky payload away from doing so.

The maintainer is the perimeter

Every one of these attacks traces back to the same weak point: a human being with publishing rights. Junon was phished. The Ledger employee was phished. The Solana and Curve maintainers were social-engineered. In the open-source model, a single tired developer clicking a convincing email can hand an attacker distribution to millions of machines. The perimeter is not a firewall; it is a person, and the attackers know it.

Increasingly, those attackers are nation-states. In June 2026, Microsoft attributed a supply-chain compromise of the Mastra AI framework, more than 140 npm packages poisoned with a typosquatted dependency that scanned for 166 different crypto wallet extensions, to Sapphire Sleet, a North Korean state actor. As Microsoft put it, it assessed “with high confidence that this activity is attributable to Sapphire Sleet, a North Korean state actor that primarily targets the financial sector.” A month later, StepSecurity documented a backdoor in eighteen Injective SDK packages built to steal wallet recovery phrases. The same regime that has spent years placing operatives inside crypto companies as employees, a story we examined in detail in our North Korea post-mortem, is now placing malware inside the packages those companies depend on. The insider and the dependency have become two doors into the same vault.

The registries are responding. After the September 2025 attacks, GitHub, which owns npm, moved to mandate phishing-resistant two-factor authentication for publishing, deprecate long-lived classic tokens, and push developers toward trusted publishing, a system that ties a package to cryptographic proof of exactly where and how it was built. The United States Cybersecurity and Infrastructure Security Agency issued an alert urging teams to pin dependency versions to known-safe releases, rotate developer credentials, and enforce phishing-resistant multifactor authentication. These are real improvements. They also arrive after the fact, and they cannot retroactively secure the millions of build systems that already pulled a poisoned version before it was caught.

What actually protects you

For an individual holder, the defense is layered, and no single layer is sufficient. The most important is verification you can trust: a hardware wallet showing you the real transaction, paired with clear signing so that what appears on the device is human-readable rather than an opaque blob. The clear-signing standard, ERC-7730, moved under Ethereum Foundation stewardship in May 2026 with backing from Ledger, Trezor, MetaMask, and others, precisely so that the string of hex you approve can be rendered as a sentence you understand. Transaction simulation, now built into many wallets, previews the likely outcome before you sign and can flag a drainer approval. Tools like revoke.cash let you claw back the standing allowances an attacker would otherwise reuse later. And for anyone running their own front-end or bot, pinned dependencies, lockfiles, and provenance checks are the equivalent of a hardware wallet for your build pipeline.

The other principle is blast-radius thinking. Keep large balances on a device you do not browse with. Use spending limits and separate signing keys so that a single compromised page cannot reach everything. Smart-account features are making this easier; as we explored in our look at account abstraction, programmable wallets can enforce per-session limits and guardians that cap what any one approval can do. None of this makes you immune. It makes a successful phish survivable.

The regulator’s blind spot

When a supply-chain phish drains a self-custodied wallet, there is no one to call. The transaction is final, there is no chargeback, and the funds are gone the moment the block confirms. In the United States, the Securities and Exchange Commission regulates crypto exchanges, custodians, and token issuers, but it does not regulate npm, DNS registrars, or the Firefox add-ons store. Software supply-chain security sits with CISA, with frameworks like SLSA, and ultimately with an open-source community that is largely unpaid and, as the qix incident showed, one stressful week away from a fatal click. That is a real gap: the attack surface that produced a $9.5 million fake app and a two-billion-download near-miss falls between the seams of financial regulation and cybersecurity policy.

Meanwhile the old-fashioned lures have not gone anywhere. In the first week of September 2026, Malwarebytes flagged a fake GTA 6 “leaked copy” site that offered a bootleg download for $50 or one SOL, then loaded drainer code that inventoried and emptied any wallet connected across seven chains, a reminder that gaming hype remains a favorite hook. Other campaigns impersonate tax authorities with fake digital-asset compliance portals. Following the stolen funds is where regulation still has teeth, through the exchanges and stablecoin issuers that touch the cash-out points, the lesson at the heart of our Binance teardown. But by the time the money reaches those chokepoints, the victim has already signed.

The bottom line

The September 2025 npm attack was a warning shot that happened to miss. An attacker gained one of the widest distribution channels in software history and, through a mix of luck, speed, and sloppiness, walked away with pocket change. Next time the payload may be cleaner, the window longer, and the target a treasury rather than a browser. The uncomfortable truth is that supply-chain phishing is not a passing trend to be patched away; it is the logical endpoint of an ecosystem built on trusted, reused, human-maintained code. The lure is disappearing because it no longer needs a lure.

For users, that means a shift in posture. Stop treating your wallet’s signing screen as a formality and start treating it as the last line of defense, because increasingly it is. Assume that any page, any package, and any extension could be quietly hostile, and structure your holdings so that being wrong once is not catastrophic. The five cents the attacker stole in 2025 was not a measure of the threat. It was a measure of how close we came, and how much work remains before the near-miss stops being luck and starts being design.

Frequently Asked Questions

What is supply-chain phishing in crypto?

Supply-chain phishing is an attack in which the malicious code that steals your crypto is delivered through software or infrastructure you already trust, rather than through a fake link or spoofed website. Examples include a poisoned npm package buried inside a dapp, a hijacked DNS record that repoints a real domain to a drainer, or a counterfeit wallet extension in an official store. Because the deception rides on trusted channels, users who follow standard safety advice can still be drained.

How much was stolen in the September 2025 npm attack?

Despite compromising packages downloaded more than two billion times a week, the attackers stole only a few hundred dollars in cryptocurrency, and by some tallies as little as a few cents of actual Ethereum, according to Socket and the Security Alliance. The theft was tiny because the malicious versions were caught within about two hours and the payload was buggy, but the exposure was enormous, which is why researchers treated it as a near-miss rather than a minor event.

Can a hardware wallet protect me from supply-chain attacks?

A hardware wallet helps only if you use clear signing and read every transaction on the device screen before approving. The September 2025 payload worked by rewriting the destination address after you clicked, so a wallet that shows you the real details on a trusted screen can catch the swap. A hardware wallet does nothing if you approve blindly or type your recovery phrase into an app or website.

Are crypto phishing losses rising or falling in 2026?

On-chain wallet-drainer phishing losses fell sharply, down about 83 percent in 2025 to roughly $83.85 million according to Scam Sniffer, and early 2026 months continued the decline. But total crypto scam revenue rose to around $17 billion in 2025 per Chainalysis, with impersonation fraud up more than 1,400 percent, so the overall picture is a shift toward higher-value, more targeted attacks rather than a genuine retreat.

How do I check whether a dapp website or wallet extension is safe?

Prefer wallets and dapps that simulate transactions before you sign, revoke unused token approvals regularly with a tool like revoke.cash, and install extensions and apps only from verified publishers after checking download history and reviews. For larger balances, use a hardware wallet with clear signing and keep spending on a separate device from the one you browse with, so that a single compromised page cannot drain everything at once.

Anneke de Vries is HOGE Wire’s security desk editor.