From Scanner to Stealer: How the Trivy Supply Chain Attack Targeted Crypto Wallets in 75+ CI/CD Pipelines

A vulnerability scanner trusted by thousands of blockchain projects was weaponized to steal Solana validator keys, Ethereum wallets, and cloud credentials — all while your security scans kept passing. The Irony That Keeps Security Researchers Up at Night On March 19, 2026, the open-source vulnerability scanner Trivy — used by thousands of organizations to find security flaws — became the attack vector itself. In a sophisticated multi-stage supply chain compromise, attackers poisoned 76 of 77 release tags in the aquasecurity/trivy-action GitHub Action, turning routine CI/CD security scans into silent credential stealers. The payload? A multi-stage exfiltration engine specifically designed to harvest cryptocurrency wallet keys, Solana validator keypairs, cloud credentials, and every secret accessible to your pipeline. If you run a blockchain project with CI/CD, this is the wake-up call you can't ignore. Attack Timeline: A Three-Week Campaign The compromise didn't happen overnight. It was