In a recent and alarming development, the Decentralized Finance (DeFi) space faced a rug-pull security breach with a supply chain attack on the Ledger ConnectKit.
<h2 id="strong-the-ledger-connectkit-attack-unveiled-strong">The Ledger ConnectKit Attack Unveiled</h2>
The vulnerability, now labeled a “supply chain attack,” poses a serious risk to users and their assets, potentially allowing malicious code injection into various Decentralized Applications (dApps). The compromised package identified in the attack is LedgerHQ’s ConnectKit, specifically versions greater than 1.1.4, according to Web3 security firm, Blockaid.
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 <img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"> We've detected a potential supply chain attack on ledgerconnect kit <img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"> The attacker injected a wallet draining payload into the popular NPM package. This currently affects a couple of popular dapps including but not limited to <a href="https://t.co/2QJmKIGv9T" rel="noopener noreferrer nofollow">https://t.co/2QJmKIGv9T</a>
 — Blockaid (@blockaid_) <a href="https://twitter.com/blockaid_/status/1735275569586090221?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">December 14, 2023</a>
</blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
The impact of the supply chain attack on Ledger ConnectKit was felt across various DeFi protocols. Blockaid mentioned that SushiSwap, Kyber, RevokeCash, and Zapper were among the vulnerable <a href="https://coingape.com/glossary/decentralized-exchange/" target="_blank" rel="noopener noreferrer nofollow">decentralized exchanges</a>.&nbsp;
Reacting promptly to the threat, Kyber and RevokeCash disabled their front ends. It is worth noting that this vulnerability comes only shortly after KyberSwap <a href="https://coingape.com/kyberswap-faces-46-million-crypto-hack-triggering-concerns-in-defi-space/" target="_blank" rel="noopener noreferrer nofollow">fell victim to a major exploit</a> that&nbsp;resulted in the loss of around $46 million in various cryptocurrencies.&nbsp;
Blockaid estimates that approximately $150,000 has been lost within just a few hours, emphasizing the immediate and widespread impact of the attack. The security firm was quick to assure users of Blockaid-enabled wallets that they are protected from this specific threat, but the broader implications of this attack could pose substantial risks to the broader Web3 ecosystem.
The origin of the vulnerability traces back to the use of a specific Content Delivery Network (CDN) to host the Ledger ConnectKit software library. Matthew Lilly, the Chief Technology Officer of Sushi, explained,&nbsp;
<blockquote>
 “LedgerHQ/connect-kit loads JS from a CDN, their CDN account has been compromised which is injecting malicious JS into multiple dApps.”
</blockquote>
<h2 id="strong-ledger-unveils-response-and-recovery-efforts-strong">Ledger Unveils Response and Recovery Efforts</h2>
In response to the attack, Ledger issued a statement acknowledging the compromise and assuring users that a genuine version of the Ledger ConnectKit is being pushed to replace the malicious file. A software patch has also been <a rel="noopener noreferrer nofollow" href="https://github.com/LedgerHQ/connect-kit/releases/tag/ck-v1.1.8" target="_blank">developed </a>to address the vulnerability.
As a precautionary measure, users are strongly advised to refrain from interacting with any dApps associated with the Ledger ConnectKit until further notice. The incident highlights the importance of continuous security audits, proactive measures, and swift responses to emerging threats to safeguard the integrity of decentralized financial systems.&nbsp;
The post <a href="https://coingape.com/rug-pull-alert-multiple-protocols-affected-in-ledger-connectkit-attack/" rel="noopener noreferrer nofollow">Rug Pull Alert: Multiple Protocols Affected in Ledger ConnectKit Attack</a> appeared first on <a href="https://coingape.com" rel="noopener noreferrer nofollow">CoinGape</a>.

Rug Pull Alert: Multiple Protocols Affected in Ledger ConnectKit Attack

Table of Contents

Coingape News Media

Other articles published on Dec 14, 2023

Argentina President Milei Devalues Peso, Receives IMF Praise but No Bitcoin Policy in Sight

Chinese grannies are coming for your airdrops

Bitget implements mandatory KYC for enhanced security

ZEC Uses zk-SNARK to Improve the Privacy of Bitcoin Transactions

Gemini Earn Users Face Potential 70% Reduction in Promised Bitcoin Payouts Under Proposed Reorgan...

Giddy Smart Wallet Collaborates With Stripe To Streamline Cryptocurrency Purchases

Join our free newsletter for daily crypto updates!