The largest theft this industry has ever seen did not break a smart contract, a key management system, a multisig, or a hardware wallet. In February 2025, attackers took roughly $1.5 billion from Bybit by compromising a developer workstation at its wallet provider and altering the JavaScript that the provider’s interface served to one specific customer. The signers saw a routine transfer on screen. Their hardware wallets signed something else.
 

Every custody control in that setup worked as designed. The cold wallet was cold and the multisig required several humans. The failure sat upstream, in code that nobody on the victim’s side wrote, reviewed, or could see changing.
 

That is the supply chain problem in a single incident. Most crypto…