Pascal

Connect

SushiSwap

ZachXBT

USDC

<p class="is-style-lead">The hard wallet maker said a former employee fell victim to a phishing scam, which allowed a hacker to access the library and steal $480,000 in crypto.</p> 
<p>Ledger’s chairman and CEO, Pascal Gauthier, attested to an exploit on Ledger Connect Kit, a Javascript library to connect Web sites to wallets on several defi platforms. Gauthier’s letter said the incident was isolated to third-party applications and stressed that Ledger’s hard wallet products remained unaffected.</p> 
<blockquote class="wp-block-quote"> 
 <p>The standard practice at Ledger is that no single person can deploy code without review by multiple parties. We have strong access controls, internal reviews, and multi-signature code when it comes to most parts of our development. This is the case in 99% of our internal systems. Any employee who leaves the company has their access revoked from every Ledger system.</p> <cite>Pascal Gauthier, chairman and CEO, Ledger</cite>
</blockquote> 
<p>However, Gauthier <a href="https://www.ledger.com/blog/a-letter-from-ledger-chairman-ceo-pascal-gauthier-regarding-ledger-connect-kit-exploit" target="_blank" rel="noopener">confirmed</a> that an ex-staff was hacked by a phishing scammer who then used compromised account access to publish a rogue WalletConnect project. This allowed bad actors to reroute user funds.&nbsp;</p> 
<p>The Dec. 14 exploit affected several defi apps like SushiSwap and Revoke.cash, crypto.news <a href="https://crypto.news/ledger-library-flaw-affects-sushiswap-revoke-cash-dapps/" data-type="link" data-id="https://crypto.news/ledger-library-flaw-affects-sushiswap-revoke-cash-dapps/">reported</a>.</p> 
<p> You might also like: <a href="https://crypto.news/ledger-library-flaw-affects-sushiswap-revoke-cash-dapps/"> Ledger library flaw affects SushiSwap, Revoke.cash dapps </a> </p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">How I understand the origins of the <a href="https://twitter.com/Ledger?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">@Ledger</a> library exploit:<br><br>– Ledger ex-dev <a href="https://twitter.com/JunichiSugiura?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">@JunichiSugiura</a> still had access to their GitHub repo<br>– He clicked the link in the phishing mail targeted at GitHub users (I also saw that mail yesterday)<br>– His GitHub account got compromised<br>– Bad… <a href="https://t.co/rrKkNdpzjO" target="_blank">https://t.co/rrKkNdpzjO</a> <a href="https://t.co/0c6jKP29RM" target="_blank">pic.twitter.com/0c6jKP29RM</a></p>— Serg // (@serglotz) <a href="https://twitter.com/serglotz/status/1735313165993271461?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">December 14, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>Ledger’s update on the issue verified observations made by crypto participants on social media. One user identified a GitHub account linked to an ex-Ledger developer, Junichi Sugiura. Gauthier’s post did not <a href="https://twitter.com/serglotz/status/1735313165993271461" target="_blank" rel="noopener">identify</a> the former employee, and Sugiura had not replied to requests for comments.&nbsp;</p> 
<p>Tether froze an address linked to the hacker, according to CTO Paolo Ardoino. Meanwhile, CertiK reported ERC-20 transactions made by wallets likely affiliated with the exploiter.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
   https://twitter.com/CertiKAlert/status/1735337013232967861?t=UyFAgyfTPaCnezW3gmd1kA&amp;s=19 
 </div>
</figure> 
<p>The exploit marked the second time in two months that phishers have leveraged Ledger to steal user funds. In November, crypto investigator ZachXBT warned users of a fake Ledger Live app on the official Microsoft app store. The fraudulent app siphoned Bitcoin (<a href="https://crypto.news/price/bitcoin/">BTC</a>) and Ether (<a href="https://crypto.news/price/ethereum/">ETH</a>) worth $768,000.</p> 
<p> Read more: <a href="https://crypto.news/ledger-to-launch-controversial-recovery-service/"> Ledger to launch controversial recovery service </a> </p>

Ledger ex-staff phished in library compromise

crypto.news

Other articles published on Dec 14, 2023

SEC Pushes Ethereum ETF Decision to February 2024!

Crypto platform CoinList to pay $1.2m to settle sanctions violation charges

Cryptocurrency Exchange That Did Not Comply With Russian Laws Reconciled With The USA!

Shiba Inu's Shibarium Celebrates Major Milestone While SHIB Price Erases Zero

Why Is Bonk Price Up Today?

Ledger security breach compromises crypto assets worth $484,000

Join our free newsletter for daily crypto updates!