Can a smart contract audit catch a supply chain attack?

Not usually. An audit verifies your contract code. Supply chain attacks go around it, through the tools, services and people that build, deploy and operate that code.

What is the first thing to do?

List what you depend on: packages, services, extensions, providers and the people with access to each. You cannot reduce a risk you have not mapped.

Supply Chain Attacks on Crypto and Web3

Supply chain attacks in crypto

A supply chain attack compromises something you trust, such as a wallet provider, an npm package, a browser extension, a build pipeline or a front end script, and uses that trust to reach you. The $1.5 billion Bybit theft came through a compromised developer machine at its wallet provider, not through Bybit's own systems.

Where the supply chain gets attacked

Service providers. Wallet interfaces, custody platforms and infrastructure providers that sit in the path of your transactions.
Packages. Compromised or malicious npm, PyPI and crate packages pulled into builds.
Developer tooling. Malicious IDE and browser extensions on the machines that write and deploy code.
Build pipelines. CI/CD systems that can be tampered with to ship altered code.
Front end scripts. Third-party analytics, widgets and libraries loaded into a dApp that can be swapped for a drainer.
Cloud credentials. Leaked keys that let an attacker change what a provider serves. Security experts suspected a leaked or compromised AWS key in the Bybit case.

Bybit, in brief

On 19 February 2025 attackers replaced a JavaScript file on app.safe.global with code built to target Bybit’s Ethereum multisig cold wallet. Two days later, during a routine transfer, signers approved a transaction that replaced the wallet’s implementation with one the attackers controlled, and about 401,000 ETH was taken. Read our post-mortem.

Reducing the risk

Lock dependency versions and review updates before they reach production.
Use reproducible builds and verify deployed code matches what was reviewed.
Audit developer environments, including extensions and plugins.
Verify high-value transactions independently of the interface that proposed them.
Assess the security of providers with access to critical systems.
Test the scenario with a red team that targets your suppliers’ access, not just your own.