Matthew Lilley, CTO of decentralized exchange SushiSwap, made a post warning investors. 
At this point, SUSHI CTO stated that investors should not interact with any dApp until further notice and announced that the platform was exposed to a security vulnerability caused by bad software. 
SUSHI CTO Lilley also added that the suspicious code originated from the GitHub page of hardware wallet provider Ledger and said: 
<blockquote> 
 “Do not interact with ANY dApp until further notice. A widely used web3 connector appears to have been compromised, allowing injection of malicious code affecting a large number of dApps.” 
</blockquote> 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 <img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"><img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"><img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"> RED ALERT <img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"><img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"><img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;">: 
 Do not interact with ANY dApps until further notice. It appears that a commonly used web3 connector has been compromised which allows for injection of malicious code affecting numerous dApps. 
 — I'm Software <img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f987.png" alt="🦇" class="wp-smiley" style="height: 1em; max-height: 1em;"><img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f50a.png" alt="🔊" class="wp-smiley" style="height: 1em; max-height: 1em;"> (@MatthewLilley) <a href="https://twitter.com/MatthewLilley/status/1735275960662921638?ref_src=twsrc%5Etfw">December 14, 2023</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
Stating that this was not a single isolated attack, but a large-scale attack against multiple dApps, CTO said that the library of hardware wallet provider Ledger was compromised. 
Making a statement on the subject, X user Squanch made the following statement: 
<blockquote> 
 Ledger's code was changed 2 hours ago with the code that automatically transfers your funds to another address when you log in with Ledger. In other words, those who connected to a wallet via Ledger in the last 2 hours are hacked. 
</blockquote> 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 Ledger’ın kodu, 2 saat önce ledgerla giriş yaptığınızda fonlarınızı otomatik olarak başka bir adrese transfer eden kod ile değiştirilmiş. Yani son 2 saat içinde ledger ile bir cüzdana,dappe bağlananlar hackleniyor. <a href="https://t.co/4p2L1RnCSb">https://t.co/4p2L1RnCSb</a> 
 — Squanch<img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f53a.png" alt="🔺" class="wp-smiley" style="height: 1em; max-height: 1em;"> (@bit_gossip) <a href="https://twitter.com/bit_gossip/status/1735283763305664652?ref_src=twsrc%5Etfw">December 14, 2023</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
Squanch later updated the statement, stating that the incident affected many more people than those connected to the wallet in just 2 hours, and stated that the situation was even worse. 
On the other hand, Curve Finance made a statement regarding the issue and used the following statements: 
<blockquote> 
 Do not select Ledger at this time when interacting with the Curve website! Ledger support on many dApps now downloads malicious code 
</blockquote> 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 When interacting with Curve website, don't choose Ledger currently! Ledger support in many dApps downloads malicious code at the moment <a href="https://t.co/lS56puIgen">https://t.co/lS56puIgen</a> <a href="https://t.co/MRQd88jdfj">pic.twitter.com/MRQd88jdfj</a> 
 — Curve Finance (@CurveFinance) <a href="https://twitter.com/CurveFinance/status/1735285404897624569?ref_src=twsrc%5Etfw">December 14, 2023</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
It is reported that there are problems on all platforms using Ledger except SushiSwap. Some DeFi platforms have announced that they have stopped accessing their websites until the problem is detected. 
It seems that the entire market, especially DeFi altcoins, experienced a decline after this news. 
<h2 id="update">Update:</h2> 
The following statement came from Ledger regarding the issue: 
<blockquote> 
 We detected and removed a malicious version of Ledger Connect Kit. An original version is currently being released to replace the malicious file. 
 Do not interact with any dApps for now. 
 We will keep you informed as the situation develops. 
 Your Ledger device and Ledger Live have not been compromised. 
</blockquote> 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 <img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;">We have identified and removed a malicious version of the Ledger Connect Kit. <img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"> 
 A genuine version is being pushed to replace the malicious file now. Do not interact with any dApps for the moment. We will keep you informed as the situation evolves. 
 Your Ledger device and… 
 — Ledger (@Ledger) <a href="https://twitter.com/Ledger/status/1735291427100455293?ref_src=twsrc%5Etfw">December 14, 2023</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
*This is not investment advice. 
 Continue Reading: <a href="https://en.bitcoinsistemi.com/attention-this-defi-altcoin-announced-it-was-hacked-warned-investors/">Attention Ledger Users: A Major Security Vulnerability Has Been Detected, These DeFi Platforms Warned Investors!</a>

Attention Ledger Users: A Major Security Vulnerability Has Been Detected, These DeFi Platforms Warned Investors!

Table of Contents

Bitcoin Sistemi EN

Other articles published on Dec 14, 2023

20,000% Growth? New Solana Meme Coin Dogwifhat (WIF) Defies Logic and Reality

Crypto Expert Predicts Rapid Growth for Cardano; Is It The Best Coin Altcoin Now?

XRP: Ripple's New Campaign Emerges in London Underground

DOGE Price Rally Refuels At $0.09 Pitstop, Eyes A 60% Jump!

Whale Buying Ethereum at $60 Made 38x! ETH Sales Started!

Dora Factory closes new strategic raise, announces new ecosystem partnerships (14 Dec)

Join our free newsletter for daily crypto updates!