Connect

Bitcoin

Security

Polygon

Balancer

In the web3 landscape,<a href="https://news.todayq.com/58-billion-crypto-lost-in-defi-exploits-post-covid-report/"> several security breaches</a> occurred in the last month, impacting not only investor sentiment but also the ongoing market rally. Amidst discussions with the Security and Exchange Commission (SEC) regarding the approval of the Bitcoin Exchange Traded Fund (ETF), the front end of several decentralized applications (DApps), including prominent platforms like Zapper, SushiSwap, Balancer, and Revoke.cash, fell victim to a security breach. DApps Zapper, SushiSwap, Balancer, and Revoke compromise 
SushiSwap’s Chief Technical Officer, Mathew Lilley, disclosed that a widely-used Web3 connector had been compromised, enabling the injection of malicious code into multiple DApps. Looking at this, the Ledger library confirmed the compromise, disclosing that the vulnerable code inserted the address of a “drainer” account. 
🚨 Urgent Security Alert 🚨We've identified a critical issue the ledger connector has been compromised, potentially allowing the injection of malicious code affecting various dApps.🔴 If you have the Sushi page open and see an unexpected 'Connect Wallet' pop-up, DO NOT… 
Behind the security breach incident, SushiSwap’s SUSHI token hasn’t been significantly affected. Currently, it is trading near $1.17, and in the last 24 hours, it has only experienced a 0.70% downward movement. 
However, Lilley placed responsibility directly on Ledger for the ongoing vulnerability and compromise across multiple DApps. He also argued that Ledger’s content delivery system (CDN) had been compromised, mentioning a series of critical errors. These included loading JavaScript from a compromised CDN without version-locking the loaded JS. 
ANY dApp which makes use of LedgerHQ/connect-kit is vulnerable. Don't use ANY dApps until further notice. This isn't a single isolated attack, it's a large-scale attack on multiple dApps. 
The Ledger connector, a fundamental library for numerous DApps maintained by Ledger, became the focal point of the attack. A wallet drainer was introduced, potentially granting unauthorized access to user assets. While autonomous draining from a user’s account may not occur, prompts from a browser wallet, such as MetaMask, could expose assets to malicious actors. Avoid Ledger Connector DApps: On-chain analysts 
On-chain analysts issued a strict warning, advising users to steer clear of any DApps using the Ledger connector. They highlighted the vulnerability of the connect-kit-loader, highlighting that any DApp utilizing LedgerHQ/connect-kit is at risk. This incident is not an isolated attack but rather a large-scale assault on multiple DApps. 
Hudson Jameson, Vice President of Polygon Labs, highlighted the need for caution even after Ledger rectified the compromised code. Projects using and deploying the library must update before it is safe to use DApps relying on Ledger’s Web3 libraries. 
Acknowledging the vulnerability, Ledger announced the removal of the malicious version of the Ledger Connect Kit. Simultaneously, efforts are underway to push a genuine version to replace the compromised file. The crypto community remains on high alert, closely monitoring updates to ensure the security of assets in the aftermath of this widespread attack. 
Get Crypto Trading Signals from Real Crypto Analysts. Join our Waiting List at todayq.com

Security breach impacts SushiSwap, Zapper, and Balancer DApps

Todayq News

Other articles published on Dec 14, 2023

BONK price blasts 53% over Coinbase listing, Solana follows

First Judicial Guidance Issued for AI Use in Courts in England and Wales

Cardano Builds Momentum As It Aims For $0.8 With Strong Support! Here’s The Next Level For ADA Price

Generative Artificial Intelligence set to transform global business landscape in 2024

LUNC and USTC Prices Gain Momentum: What Developments are Catching Attention in the Terra Ecosystem?

Fantom’s 18% Spike May Only Be the Beginning as FTM Bulls Target Massive Breakout at This Price

Join our free newsletter for daily crypto updates!