Connect

<p>The hacker responsible for the attack on Ledger’s connector library has stolen assets worth around $484,000. This information was provided by the blockchain analysis platform Lookonchain. Although Ledger has not yet confirmed these figures, they have stated that the security breach could have a significant impact, potentially amounting to hundreds of thousands of dollars.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">A hacker attacked <a href="https://twitter.com/hashtag/Ledger?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">#Ledger</a> and has stolen ~$484K assets.<a href="https://twitter.com/hashtag/LedgerExploiter?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">#LedgerExploiter</a> transferred 4.334 <a href="https://twitter.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">$ETH</a> to <a href="https://twitter.com/hashtag/AngelDrainer?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">#AngelDrainer</a>.<br><br>And the <a href="https://twitter.com/hashtag/AngelDrainer?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">#AngelDrainer</a> is also receiving assets currently and holds $363K assets.<a href="https://t.co/ZG5SRlKBjW" rel="noopener noreferrer nofollow" target="_blank">https://t.co/ZG5SRlKBjW</a> <a href="https://t.co/RK9aPyAjEE" rel="noopener noreferrer nofollow" target="_blank">pic.twitter.com/RK9aPyAjEE</a></p>— Lookonchain (@lookonchain) <a href="https://twitter.com/lookonchain/status/1735309710356877615?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">December 14, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<h2 class="wp-block-heading" id="the-hack-and-its-immediate-impact">The hack and its immediate impact</h2>
<p>Cryptopolitan <a href="https://www.cryptopolitan.com/sushi-users-advised-to-stop-all-transactions/" rel="noopener noreferrer nofollow">reported</a> earlier that the breach occurred when malicious code was inserted into Ledger’s Github library for Connect Kit, a crucial component many DeFi protocols use to interface with cryptocurrency hardware wallets. The malicious code affected the front-end of all applications utilizing the Connect Kit. Major protocols such as Sushi, Lido, Metamask, and Coinbase were among those impacted by this security lapse.</p>
<p>In response to the incident, Ledger acknowledged that one of its employees fell victim to a phishing attack, leading to the unauthorized publication of a compromised version of the Ledger Connect Kit. The former employee’s name and email showed up in the compromised code. It is important to know that the crypto community initially thought the developer was responsible for the exploit. However, Ledger later declared that the attack resulted from an ex-employee falling victim to a phishing attack.&nbsp;</p>
<p>The company acted promptly, identifying and removing the harmful version of the software. However, despite Ledger’s quick response, the damage had already been done in approximately two hours, during which the hackers drained funds.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">FINAL TIMELINE AND UPDATE TO CUSTOMERS:<br><br>4:49pm CET:<br><br>Ledger Connect Kit genuine version 1.1.8 is being propagated now automatically. We recommend waiting 24 hours until using the Ledger Connect Kit again.<br><br>The investigation continues, here is the timeline of what we know about…</p>— Ledger (@Ledger) <a href="https://twitter.com/Ledger/status/1735326240658100414?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">December 14, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<h2 class="wp-block-heading" id="broader-implications-for-the-defi-community">Broader implications for the DeFi community</h2>
<p>This incident raises significant concerns about the security infrastructure of decentralized applications. DeFi protocols often rely on code from various software providers, including Ledger, making them vulnerable to multiple potential points of failure. This vulnerability was starkly highlighted in this incident, emphasizing the need for heightened security measures across the DeFi ecosystem.</p>
<p>The hack affected direct users of Ledger’s services and extended to users of services like revoke.cash. This service, typically used to remove permissions from DeFi protocols after security breaches, was also compromised. Users attempting to secure their assets were inadvertently led to a malicious token drainer, thereby broadening the scope of the theft.</p>
<p>MetaMask, a popular wallet provider, was also affected by the breach. The company deployed a fix for its platform two hours after the attack, ensuring that users on the latest version were safe from the exploit.</p>
<h2 class="wp-block-heading" id="ledger-s-continued-challenge-with-security">Ledger’s continued challenge with security</h2>
<p>This is not the first time Ledger has faced security issues. In 2020, the company suffered a significant data breach when its customer database was leaked, raising concerns about sim swapping and home invasion threats. Furthermore, Ledger faced controversy over discrepancies between its hardware’s marketed and actual security in a software update this past year.</p>
<p>The recent hacking incident underscores the fragile nature of decentralized applications and the critical importance of robust security protocols. While Ledger has taken steps to mitigate the impact of this breach, the DeFi community remains alert to the ongoing challenges of ensuring the security of its assets in an increasingly complex digital financial industry.&nbsp;</p>

Ledger security breach compromises crypto assets worth $484,000

Table of Contents

Cryptopolitan_News

Other articles published on Dec 14, 2023

Coinbase Boosts Bonk and Goes Global with Dual Announcements

Analysts Foresee Ripple (XRP) To Achieve This Key Milestone By 2024

Riding the Bitcoin Wave: Will ORDI Continue Its Remarkable Rise?

Putin faces AI’s tough questions on doubles and AI dangers

Dormant Ethereum (ETH) Whale Reawakens to Spark Sell-off Fears

Bitget Wallet Partners Up with Linea, Aims to Collaboratively Develop the Layer 2 Ecosystem (14 Dec)

Join our free newsletter for daily crypto updates!