Connect

SushiSwap

<div class="cryptonews">
 <p class="is-style-lead">SushiSwap Chief Technical Officer Mathew Lilley has disclosed the compromise of a widely employed web3 connector within Ledger’s delivery network.&nbsp;</p>
 <p>The breach has enabled malicious code injection into numerous decentralized applications (<a rel="noopener noreferrer nofollow" title="dapps" href="https://thebittimes.com/tag/dapps.html">dapps</a>).&nbsp;</p>
 <h2 class="wp-block-heading" id="removal-of-malicious-provider">Removal of malicious provider&nbsp;</h2>
 <p>Lilley contended that Ledger’s content delivery network was compromised, leading to the loading of JavaScript from the compromised network.</p>
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
  <div class="wp-block-embed__wrapper">
   <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
    <p lang="en" dir="ltr">RED ALERT : <br><br>Do not interact with ANY dApps until further notice. It appears that a commonly used web3 connector has been compromised which allows for injection of malicious code affecting numerous dApps.</p>— I'm Software (@MatthewLilley) December 14, 2023
   </blockquote>
  </div>
 </figure>
 <p>The compromised Ledger connector <a rel="noopener noreferrer nofollow" title="library" href="https://thebittimes.com/tag/library.html">library</a>, widely employed by various <a rel="noopener noreferrer nofollow" title="dapps" href="https://thebittimes.com/tag/dapps.html">dapps</a> and overseen by Ledger, has seen the addition of a wallet drainer. While assets may not be drained automatically from a user’s account, prompts from browser wallets like MetaMask could potentially provide malicious actors access to the assets, according to Lilley’s claims.</p>
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
  <div class="wp-block-embed__wrapper">
   <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
    <p lang="en" dir="ltr">We have identified and removed a malicious version of the Ledger Connect Kit. <br><br>A genuine version is being pushed to replace the malicious file now. Do not interact with any dApps for the moment. We will keep you informed as the situation evolves. <br><br>Your Ledger device and…</p>— Ledger (@Ledger) December 14, 2023
   </blockquote>
  </div>
 </figure>
 <div class="cn-block-related-link">
  <svg class="cn-block-related-link__icon icon" aria-hidden="true"><use xlink:href="#"></use>
  </svg> <span class="cn-block-related-link__prefix"> You might also like: </span> Red Alarm flags hundreds of risky dapps on BNB Chain
 </div>
 <p>The renowned cryptocurrency hardware wallet provider has since taken to X to announce the identification and removal of a malicious version of the Ledger Connect Kit. The company urges users to exercise caution and temporarily abstain from engaging with <a rel="noopener noreferrer nofollow" title="dapps" href="https://thebittimes.com/tag/dapps.html">dapps</a>.</p>
 <p>Assuring the community of their proactive stance, Ledger has already initiated the deployment of a genuine replacement for the compromised file. Ledger also emphasizes that the security of user Ledger devices and Ledger Live remains intact, with no compromise detected.</p>
 <h2 class="wp-block-heading" id="an-ongoing-target">An ongoing target</h2>
 <p>This is not the first time Ledger has been a target of malicious acts. On Nov. 5, crypto investigator ZachXBT raised an alert on the X platform regarding a fraudulent application named Ledger Live Web3.&nbsp;</p>
 <p>This deceptive application mimicked the legitimate Ledger Live app, an official user interface for storing crypto assets offline using hardware wallets, effectively causing users to lose $800,000.</p>
 <div class="cn-block-related-link">
  <svg class="cn-block-related-link__icon icon" aria-hidden="true"><use xlink:href="#"></use>
  </svg> <span class="cn-block-related-link__prefix"> Read more: </span> Staying safe in web3: your guide to dapps security
 </div>
 <p></p> <span class="google-news-banner__label">Follow Us on Google News</span>
</div>
<p>Source: <a rel="noopener noreferrer nofollow" target="_blank" href="https://thebittimes.com/ledger-library-flaw-affects-sushiswap-revoke-cash-dapps-tbt73695.html">https://thebittimes.com/ledger-library-flaw-affects-sushiswap-revoke-cash-dapps-tbt73695.html</a></p>

Ledger library flaw affects SushiSwap, Revoke.cash dapps

Table of Contents

TheBitTimes

Other articles published on Dec 14, 2023

Crypto Justice: The United States Makes a Landmark Conviction in Smart Contract Hacking

Bitcoin Minetrix (BTCMTX) and Meme Kombat (MK) Are Top Tokens Primed For Exponential Growth in Q1 24

Hackers Stole $484K In Ledger Supply Chain Attack; Tether Steps In by Freezing Funds

Wizarre 1.0 patch notes

Injective (INJ) Smashes Past $30 – Will Price Discovery Take it to $40?

Axie Infinity The Launch of Axie Part Evolutions: A New Era for Axie Infinity

Join our free newsletter for daily crypto updates!