Charles Guillemet, chief technology officer at Ledger, warned on Monday that a major supply chain attack is underway after a trusted developer’s NPM account was taken over. The compromised packages, Guillemet said, already have more than 1,000,000,000 downloads.
The injected code quietly swaps crypto wallet addresses in transactions, so people can end up sending funds to the attacker without knowing how it happened.
How does the attack work?
Guillemet explained that the attacker added code to popular JavaScript packages. Those packages are used by developers across many projects.
When an app or wallet uses the tainted package, the code can change the address in a transaction. The user thinks they are sending to the right address. In fact, the money goes to the attacker.
This method targets the software supply chain. It uses a trusted developer account as an entry point. Once the account is compromised, attackers can push malicious updates that reach many projects fast.
Who is at risk?
Any decentralised app or software wallet that includes the affected JavaScript packages may be exposed. Guillemet warned that the problem crosses blockchains, and if a wallet or dapp calls the infected code, users could lose funds.
He urged users and developers to assume that widely used packages may be unsafe until checks are done.
Also Read: OpenSea Data Hack Exposes 7M User Emails, Security Risk Looms
Ledger’s advice
Guillemet said the most reliable protection is a hardware wallet with a secure screen that supports Clear Signing. With a secure screen, users can view the exact address on the device before they approve a transaction.
That makes it much harder for malicious code to trick someone. He added that hardware wallets without secure displays and any wallet that does not support Clear Signing face a higher risk. He told users to verify transactions and to avoid blind signing.
Ledger also said its devices were not at risk from this particular ecosystem-wide attack. The company said its hardware shows the real address on a protected screen before signing.
Ledger said users’ private keys and recovery phrases remain safe. The company encouraged users to check transaction details on the device every time.
Reactions from the wider industry
CZ, the CEO of Binance, noted that open-source software is no longer automatically safe. He said the incident shows Web 3 will push different security demands on older Web 2 tools. He called the field still early and evolving.
MetaMask responded by saying its products include several lines of defence. The company said it locks versions, uses manual and automated checks, and keeps a careful release process.
MetaMask also said it uses tools that limit what malicious code can do and services that flag risky addresses quickly. The team told users there is no need to panic, and that they work to keep apps and accounts safe.
Reports suggest attackers also targeted other package maintainers and developers with phishing messages sent to the same email. Those who received the messages said the attackers tried to trick them into revealing access.
Context and past attacks
Security observers compare this breach to earlier supply chain thefts. In 2025, attackers linked to North Korea were blamed for draining more than $1,500,000,000 from crypto platforms.
Chainalysis has said the Lazarus Group was behind over $3,000,000,000 in crypto theft between 2017 and 2025. Those campaigns often rely on compromising trusted developer tools or accounts.
Such incidents demonstrate the severe consequences of even the smallest lapses in developer security. With one compromised account, the attacker can inject malignant code into multiple projects simultaneously. This can result in immediate damage to the entire crypto ecosystem.
Developers should conduct audits of their dependencies and determine the authorship of the respective components. They need to investigate the changes and ensure the updates are real.
This incident is a reminder that code supply chains can be weak points. The cryptocurrency community relies heavily on open-source tools, making careful checks and device-level verification critical.
For now, users and teams should assume risk, verify every transaction on a secure screen, and treat any unexpected update with caution.
Also Read: Sequoia Capital’s Roelof Botha Hit in Coinbase Data Hack, Personal Data Exposed