Supply Chain Attack (DeFi)
Web3 / wallets security
A DeFi supply chain attack targets the software development infrastructure surrounding a protocol — CI/CD pipelines, open-source dependencies, developer tooling, and cloud configuration management — rather than the smart contracts themselves. By injecting malicious payloads into widely-used tools that developers trust, attackers can harvest private keys, AWS credentials, wallet seeds, and API tokens from the build environments of dozens or hundreds of projects simultaneously. The attack is particularly effective in DeFi, where small development teams use shared open-source tooling and where a single compromised AWS credential can control minting keys with unlimited authority. Example: In March 2026, the cybercriminal group TeamPCP compromised Trivy, an open-source vulnerability scanner used by thousands of organizations, by force-pushing malicious payloads to 75 of 76 version tags — embedding an infostealer that harvested AWS credentials, SSH keys, and Kubernetes tokens from CI/CD runner environments, with the operation occurring on the same day as the Resolv Labs hack. Why it matters for wallets and security: Supply chain attacks bypass the entire smart contract audit process. Eighteen security reviews of Solidity code offer zero protection if an attacker harvests the AWS credentials that control the minting key from a developer's build pipeline. The attack surface for DeFi protocols now extends to every dependency in their software development lifecycle.
Explore the full Web3 Glossary — 2,000+ expert-curated definitions. Need guidance? Talk to our consultants.