Source: iStock / welcomia 
Multiple popular decentralized applications (dApps) have been compromised following a hack against a popular Web3 connector on Wednesday, numerous software experts confirmed on Thursday. 
“Do not interact with ANY dApps until further notice,” warned Matthew Lilley, CTO of SushiSwap, in a <a href="https://twitter.com/matthewlilley/status/1735275960662921638?s=46&amp;t=CylSDpzJYKjxzNzem3ECRA">post</a> to X. “It appears that a commonly used web3 connector has been compromised which allows for injection of malicious code affecting numerous dApps.” 
The connector in question is “Ledger Connector,” a tool from the popular wallet provider that lets crypto users connect their mobile wallets to decentralized apps like exchanges and lending platforms. 
As such, the attack doesn’t solely affect one dApp, but any that may use Ledger’s connect kit. 
 RED ALERT : 
Do not interact with ANY dApps until further notice. It appears that a commonly used web3 connector has been compromised which allows for injection of malicious code affecting numerous dApps. 
— I'm Software (@MatthewLilley) <a href="https://twitter.com/MatthewLilley/status/1735275960662921638?ref_src=twsrc%5Etfw">December 14, 2023</a> 
Shortly thereafter, Ledger <a href="https://twitter.com/Ledger/status/1735291427100455293">confirmed</a> that the malicious code had been identified and removed from its libraries and that user wallets had not been compromised. 
“A genuine version is being pushed to replace the malicious file now,” the company stated. 
Other X users like <a href="https://twitter.com/bantg/status/1735279127752540465">@bantg</a> confirmed in advance that Ledger’s software library had been compromised and “replaced with a drainer,” with new fields like “minimalDrainValue” inserted into its code. 
Given the frequency of <a href="https://twitter.com/frankresearcher/status/1735279426261168393?s=46&amp;t=CylSDpzJYKjxzNzem3ECRA">new updates</a> to the database in the last few hours, onlookers didn’t believe the real Ledger company was responsible. 
According to <a href="https://twitter.com/officer_cia/status/1735276914321846498?s=46&amp;t=CylSDpzJYKjxzNzem3ECRA">@officer_cia</a> – a hacker relations expert for Web3 security firm Remedy – some affected dApps included Sushi, as well as the DeFi dashboard Zapper, and “wallet hygiene” service Revoke.cash. 
<h2 id="stay-away-from-dapps-expert-warn">Stay Away From dApps, Expert Warn</h2> 
 Polygon Labs VP Hudson Jameson has acknowledged the hack and also warned crypto users to not use any dApps. “This is an ongoing situation and it is risky to use dApps currently if you don’t understand what backend libraries they use,” he <a href="https://twitter.com/hudsonjameson/status/1735283602340843757">said</a>. 
While visiting dApp websites alone won’t allow users’ funds to be drained, certain prompts from browser wallets – such as <a href="https://cryptonews.com/news/metamask-expands-global-presence-with-payment-partnerships-across-six-countries.htm">MetaMask</a> – will invite users to mistakenly forfeit their assets to hackers. 
“Does Ledger know about this? Yes they do and are working on it,” said Jameson. Nevertheless, projects using Ledger’s library will need to “update things” even after Ledger corrects for any malicious code. 
This is the second time this year that Ledger has<a href="https://cryptonews.com/news/ledgers-ceo-claims-new-key-recovery-service-streamlines-crypto-self-custody-amid-ongoing-controversy.htm"> come under fire</a> for poor security practices. 
In May, Ledger was blasted for its “Ledger Recover” wallet service, which triggered concern that the accompanying firmware update would allow users’ private keys to be extracted from their wallets. 
After criticism cooled off, the company <a href="https://cryptonews.com/news/ledger-debuts-cloud-based-private-key-recovery-tool-despite-previous-backlash.htm">debuted</a> the product the late October.

Breaking: On-Chain Data Suggests Popular Decentralized Applications are Compromised – Here’s the Latest

Table of Contents

Cryptonews.com

Other articles published on Dec 14, 2023

Cardano Builds Momentum As It Aims For $0.8 With Strong Support! Here’s The Next Level For ADA Price

Bitwise advances in US spot Bitcoin ETF race, eyes approval

Defi Protocol Yearn. finance appeals to traders for return of lost $1.4 million

Scorpion Casino is Predicted to Top the Web3 Gambling Market in 2024 – What Does That Mean for Ea...

Ledger Suffers Supply Chain Attack!

Ethereum Gaming Altcoin Rallies As Massive Whale Withdraws From Binance: On-Chain Data

Join our free newsletter for daily crypto updates!