News

Ledger CTO Warns of Supply Chain Attack, Cautions Against On-Chain Transactions

Ledger CTO cautions that there is an NPM supply chain attack on the rampage. He encouraged users to cease risky on-chain transactions.
Published by
Ledger CTO Warns of Supply Chain Attack, Cautions Against On-Chain Transactions

Highlights

  • Ledger CTO issues warning about crypto supply chain attack threat to millions of wallets.
  • Malicious NPM updates spread malware that steals and replaces crypto addresses.
  • Developers encouraged developer to cease on-chain operation, and inspect HD wallets thoroughly.

The JavaScript ecosystem is under a massive threat following a major supply chain attack. Hence, millions of crypto users and developers are now at risk. With more than a billion of these packages downloaded already, thousands of blockchain wallets and applications could be suffer varying exploits.

Advertisement

Supply Chain Attack Injects Malware Into Core NPM Packages

Ledger CTO Charles Guillemet warned that a compromised Node Package Manager (NPM) account has led to malicious updates in widely used packages, including error-ex, color-convert, and strip-ansi. Security researchers discovered that the injected malware functions as a “crypto-clipper.” It silently hijacks wallet addresses in network requests and replaces them with addresses controlled by the attacker.


The supply chain attack activates whether or not a crypto wallet is detected. If a wallet such as MetaMask is present, the malware directly intercepts and manipulates transaction requests.  It scans data for wallet addresses in Bitcoin, Ethereum, Solana, Tron, Litecoin, and other networks.

These are replaced with similar-looking attacker addresses using a string-matching algorithm. The deception makes it difficult for victims to notice changes. Recently, World Liberty Financial disclosed why it blacklisted 272 wallets, highlighting broader risks facing wallet security.

Developers first spotted the malicious code from the supply chain attack after a cryptic build failure during a pipeline run. Instead of the stable version 1.3.2, their systems installed a newly published 1.3.3 version of error-ex. That release contained heavily obfuscated code, including a suspicious function named checkethereumw. Investigation confirmed it was stealing crypto data and redirecting funds.

Advertisement

Developers Urged to Strengthen Defenses as Supply Chain Threat Widens

Guillemet urged caution. He advised users with hardware wallets to carefully check each transaction before signing. For those without hardware protection, he recommended pausing all on-chain transactions until the threat is resolved. He added that it remains unclear whether attackers can directly steal wallet seed phrases from software wallets.

New revelations, including a report by Arkham about the 127,426 Bitcoin hack on the Lubian mining pool, highlights the possible extent of exploits, including a supply chain attack. Despite mounting fears, Solana’s top DEX-aggregator Jupiter said it is unaffected. The team said Jupiter and Jup Mobile do not use compromised package versions. They added that they’ve reviewed the source code and assured users their products are safe.

Advertisement

Share
Paul

Paul Adedoyin is a crypto journalist with 4+ years experience who provides timely news, in-depth research, and insightful content to inform and empower his audience. His works have been featured on sites such as CryptoMode, CryptoNewsFlash among others. He holds a degree in Geophysics from OAU, Nigeria. When he's not writing, he loves watching soccer and reading educative journals. He can be reached via paul@coingape.com

Published by
Why trust CoinGape: CoinGape has covered the cryptocurrency industry since 2017, aiming to provide informative insights to our readers. Our journalists and analysts bring years of experience in market analysis and blockchain technology to ensure factual accuracy and balanced reporting. By following our Editorial Policy, our writers verify every source, fact-check each story, rely on reputable sources, and attribute quotes and media correctly. We also follow a rigorous Review Methodology when evaluating exchanges and tools. From emerging blockchain projects and coin launches to industry events and technical developments, we cover all facets of the digital asset space with unwavering commitment to timely, relevant information.
Investment disclaimer: The content reflects the author’s personal views and current market conditions. Please conduct your own research before investing in cryptocurrencies, as neither the author nor the publication is responsible for any financial losses.
Ad Disclosure: This site may feature sponsored content and affiliate links. All advertisements are clearly labeled, and ad partners have no influence over our editorial content.

Recent Posts

  • News

Ripple’s Chris Larsen Expands XRP Realized Profit to $764M Amid Evernorth Deal

Ripple executive chairman Chris Larsen has amassed millions in realized profit from XRP withdrawals since…

October 23, 2025
  • News

Just In: Hyperliquid Strategies Eyes $1B Capital Raise, Plans HYPE Token Accumulation

Hyperliquid Strategies has filed with the U.S. SEC to raise up to $1 billion through…

October 23, 2025
  • News

Senators Reaffirm Commitment to Market Structure Bill After Meeting with Coinbase, Ripple

Senate Democrats and Republican lawmakers have ended separate roundtable meetings focused on the Crypto Market…

October 23, 2025
  • News

How the Crypto Market Could React to the Next Fed Meeting on October 29?

The crypto market has, for a while now, been pricing a potential 25 basis points…

October 23, 2025
  • News

$1.68 Trillion T. Rowe Price Files for First Active Crypto ETF Holding BTC, ETH, SOL, and XRP

Rowe Price has filed for its first actively managed crypto exchange-traded fund (ETF). It is…

October 22, 2025
  • News

Standard Chartered Predicts Bitcoin Could Drop Below $100K Amid U.S.–China Trade Tensions

Standard Chartered analyst Geoff Kendrick has predicted that the Bitcoin price could suffer a significant…

October 22, 2025