Why Crypto Security Fails at the Wallet, Not the Chain

Bitcoin and Ethereum have never been hacked at the protocol level in any way that mattered to an ordinary user. Every major crypto theft you’ve heard about happened somewhere else: in a browser extension, a phone’s app store, or a line of code buried three dependencies deep in software a wallet relies on without anyone realizing it. In September 2025, attackers proved this at global scale by compromising a handful of ordinary JavaScript packages that power a huge share of the modern web, turning code that had nothing to do with crypto into a tool for rewriting wallet transactions before they were ever signed.

This is the part of crypto security competing coverage keeps getting backward. The chain is the boring, reliable part. The wallet, and everything feeding into it, is where security actually breaks.

Key Facts

TL;DR

• Blockchain consensus has an extremely strong security track record. The software layer that lets humans interact with it does not.
• The September 2025 npm attack proved that a wallet doesn’t need to be tricked by a fake website to be compromised. It can be compromised through a software dependency the user never knowingly installed at all.
• Hardware wallets don’t eliminate this risk by themselves. Trezor doesn’t publish an official iOS app, which is exactly what made a fake one so easy to pass off as real, twice, in two different years.
• App store review, whether Apple’s or Google’s, is not a reliable security guarantee for crypto-specific apps, since fraudulent listings have repeatedly slipped through.
• The common thread across both cases is that neither attacker needed to break any cryptography. They needed to get positioned somewhere in the software supply chain a wallet, or its user, trusted by default.

What the Blockchain Actually Secures, and Where That Security Ends

A blockchain’s security guarantee is narrow and specific: once enough of the network agrees a transaction is valid, nobody can quietly alter that record afterward. Bitcoin and Ethereum have maintained this guarantee for well over a decade without a successful direct attack on consensus itself affecting user funds.

None of that protects the software between a person and the blockchain. A wallet is really just an interface: a piece of software that generates and stores keys, builds transactions, and asks the user to sign them. If that software is compromised, tampered with, or counterfeit, the underlying blockchain will faithfully and permanently record whatever fraudulent transaction it’s asked to process, because the blockchain has no way to know the wallet itself was compromised.

The npm Attack: When the Supply Chain Becomes the Attack Surface

On September 8, 2025, a developer known by the handle Qix, who maintains widely used JavaScript packages including chalk, received a phishing email disguised as an npm security notice. After his credentials were compromised, attackers published malicious versions of 18 packages, tools so deeply embedded in modern web development that they collectively see more than two billion downloads a week, often as invisible dependencies of much larger frameworks.

The injected code specifically targeted crypto wallet activity in the browser. It hooked into wallet-connection functions like Ethereum’s window.ethereum interface and Solana’s signing methods, then silently rewrote the destination address of a transaction before it reached the user’s wallet for signing. A user could check their wallet’s confirmation screen, see what looked like a normal transaction, and still have funds sent to an attacker, because the manipulation happened upstream of the signature step itself.

The attack was detected and largely contained within hours, and most individual crypto holders were likely unaffected because exposure required a website to have pulled in a freshly compromised package version during a narrow window. But the mechanism matters more than the outcome. This wasn’t phishing in the traditional sense. No user clicked a suspicious link or connected to a fake site. The compromise happened in code that developers, not end users, chose to trust, which is precisely why it’s a category of risk ordinary security advice (“don’t click suspicious links”) does nothing to address.

Fake Wallet Apps: When the App Store Itself Becomes the Vector

A different, older failure mode shows the same underlying pattern from the user’s side rather than the developer’s side. In 2021, a counterfeit app simply called “Trezor” appeared on Apple’s App Store, despite Trezor, a well-known hardware wallet maker, never having published an official iOS app. According to reporting by the Washington Post, the app initially listed itself under a cryptography category, describing itself as a tool for encrypting files, before switching its behavior to present itself as a crypto wallet. One user, Phillipe Christodoulou, downloaded it specifically to check the balance on his Trezor hardware wallet and lost approximately $600,000 in Bitcoin within seconds of entering his credentials.

The same pattern recurred in 2023 with a different fake listing, “Trezor Wallet Suite,” which directly asked users for their seed phrase, the master key to a hardware wallet’s holdings, and again managed to appear prominently in App Store search results before being taken down.

Neither case involved a flaw in Trezor’s actual hardware or software. Both involved the absence of an official app creating exactly the gap a convincing fake could fill, combined with app store review processes that did not catch the impersonation before real users were harmed.

Comparison: Where Each Attack Actually Happens

Who Benefits, and Who Absorbs the Risk

Attackers benefit from the sheer scale these vectors offer. A single compromised npm maintainer account reached packages downloaded billions of times in a week; a single fake app listing can sit at the top of search results for weeks before anyone reports it. Software maintainers and platform operators, npm’s registry, Apple’s App Store, bear some reputational and remediation cost, but as both cases show, the financial loss lands on individual users, who had no visibility into either the dependency chain behind a website or the true publisher behind an app listing.

Practical Guidance

• Use a hardware wallet that displays transaction details, including the destination address, on its own separate screen, since this defeats browser-based interception like the npm attack, which relies on the browser’s display being trusted blindly.
• Before downloading any wallet-related app, go directly to the official company’s website to find the correct, verified download link rather than searching within an app store.
• Be skeptical of any wallet-related app if the company is publicly known not to offer a mobile app in that store, which was true of Trezor on iOS in both fake-app incidents.
• If you’re a developer building anything that touches crypto wallets, pin dependency versions and review automated updates rather than trusting the latest release of a package by default.
• Treat “the app store reviewed it” or “the code is on GitHub” as weak signals, not proof of safety. Both npm and Apple’s App Store have hosted actively malicious crypto software.

What Happens Next

Expect supply-chain attacks targeting crypto wallets to keep increasing rather than fading, since the payoff for attackers scales with how many downstream users a single compromised package or app reaches. Security researchers have already flagged open-source package ecosystems, both npm and Python’s PyPI, as recurring targets for exactly this kind of crypto-focused malware. On the app store side, expect continued cat-and-mouse between platform operators removing fraudulent listings and new ones appearing under slightly different names, since neither Apple nor Google has published a crypto-specific verification process beyond standard app review.

FAQs

Did the September 2025 npm attack actually break blockchain security? No. It compromised software dependencies used by websites to interact with wallets, intercepting and rewriting transactions before they were signed. The blockchain itself processed those transactions correctly, exactly as it was designed to.

How did a fake Trezor app get onto the official Apple App Store? By initially describing itself as an unrelated utility app during Apple’s review process, then changing its behavior afterward to impersonate a crypto wallet, a technique sometimes called a bait-and-switch.

Does a hardware wallet protect against a compromised npm package? Largely yes, because a genuine hardware wallet displays the actual transaction details on its own physical screen, independent of the browser, allowing a user to catch a mismatched destination address before signing.

Is app store review a reliable way to confirm a crypto wallet app is legitimate? No. Both Apple’s and Google’s app stores have hosted fraudulent wallet apps that passed initial review before being reported and removed.

Sources

• Wiz, “Widespread npm Supply Chain Attack: Breaking Down Impact & Scope Across Debug, Chalk, and Beyond”
• Sygnia, “16 Minutes to Impact: npm Supply Chain Abuse Deploys Crypto-Draining Malware”
• Cycode, “npm debug / chalk Supply-Chain Attack: The Complete Guide”
• Decrypt, “Fake Trezor iPhone App Scams User Out of $600,000 in Bitcoin”
• Decrypt, “There’s a Fake Trezor Wallet in the Apple App Store Draining Crypto”

This article is for educational purposes and does not constitute financial or legal advice. Cryptocurrency transactions carry risk of irreversible loss. If you believe you have been targeted by fraud, contact IC3.gov or the FTC directly.