Pascal

Connect

SushiSwap

ZachXBT

USDC

<div class="cryptonews">
 <p class="is-style-lead">The hard wallet maker said a former employee fell victim to a phishing scam, which allowed a hacker to access the <a rel="noopener noreferrer nofollow" title="library" href="https://thebittimes.com/tag/library.html">library</a> and steal $480,000 in crypto.</p>
 <p>Ledger’s chairman and CEO, Pascal Gauthier, attested to an exploit on Ledger Connect Kit, a Javascript <a rel="noopener noreferrer nofollow" title="library" href="https://thebittimes.com/tag/library.html">library</a> to connect Web sites to wallets on several defi platforms. Gauthier’s letter said the incident was isolated to third-party applications and stressed that Ledger’s hard wallet products remained unaffected.</p>
 <blockquote class="wp-block-quote">
  <p>The standard practice at Ledger is that no single person can deploy code without review by multiple parties. We have strong access controls, internal reviews, and multi-signature code when it comes to most parts of our development. This is the case in 99% of our internal systems. Any employee who leaves the company has their access revoked from every Ledger system.</p> <cite>Pascal Gauthier, chairman and CEO, Ledger</cite>
 </blockquote>
 <p>However, Gauthier confirmed that an ex<a rel="noopener noreferrer nofollow" title="-staff" href="https://thebittimes.com/tag/staff.html">-staff</a> was hacked by a phishing scammer who then used compromised account access to publish a rogue WalletConnect project. This allowed bad actors to reroute user funds.&nbsp;</p>
 <p>The Dec. 14 exploit affected several defi apps like SushiSwap and Revoke.cash, crypto.news reported.</p>
 <div class="cn-block-related-link">
  <svg class="cn-block-related-link__icon icon" aria-hidden="true"><use xlink:href="#"></use>
  </svg> <span class="cn-block-related-link__prefix"> You might also like: </span> Ledger library flaw affects SushiSwap, Revoke.cash dapps
 </div>
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
  <div class="wp-block-embed__wrapper">
   <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
    <p lang="en" dir="ltr">How I understand the origins of the @Ledger <a rel="noopener noreferrer nofollow" title="library" href="https://thebittimes.com/tag/library.html">library</a> exploit:<br><br>– Ledger ex-dev @JunichiSugiura still had access to their GitHub repo<br>– He clicked the link in the phishing mail targeted at GitHub users (I also saw that mail yesterday)<br>– His GitHub account got compromised<br>– Bad… https://t.co/rrKkNdpzjO pic.twitter.com/0c6jKP29RM</p>— Serg // (@serglotz) December 14, 2023
   </blockquote>
  </div>
 </figure>
 <p>Ledger’s update on the issue verified observations made by crypto participants on social media. One user identified a GitHub account linked to an ex-Ledger developer, Junichi Sugiura. Gauthier’s post did not identify the former employee, and Sugiura had not replied to requests for comments.&nbsp;</p>
 <p>Tether froze an address linked to the hacker, according to CTO Paolo Ardoino. Meanwhile, CertiK reported ERC-20 transactions made by wallets likely affiliated with the exploiter.</p>
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
  <div class="wp-block-embed__wrapper">
   <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
    <p lang="en" dir="ltr">#CertiKSkynetAlert <br><br>After the Ledger exploiter was blacklisted by Tether, the exploiter transferred numerous ERC-20 tokens to EOA 0x1b9f9964A073401a8BC24f64491516970bB84E47 including USDC and stETH<br><br>60k USDC and ~34 stETH have been swapped for ETH<br><br>EOA 0x1b9 holds ~$158k pic.twitter.com/dMxIv4wiwH</p>— CertiK Alert (@CertiKAlert) December 14, 2023
   </blockquote>
  </div>
 </figure>
 <p>The exploit marked the second time in two months that phishers have leveraged Ledger to steal user funds. In November, crypto investigator ZachXBT warned users of a fake Ledger Live app on the official Microsoft app store. The fraudulent app siphoned Bitcoin (BTC) and Ether (ETH) worth $768,000.</p>
 <div class="cn-block-related-link">
  <svg class="cn-block-related-link__icon icon" aria-hidden="true"><use xlink:href="#"></use>
  </svg> <span class="cn-block-related-link__prefix"> Read more: </span> Ledger to launch controversial recovery service
 </div> <span class="google-news-banner__label">Follow Us on Google News</span>
</div>
<p>Source: <a rel="noopener noreferrer nofollow" target="_blank" href="https://thebittimes.com/ledger-ex-staff-phished-in-library-compromise-tbt73738.html">https://thebittimes.com/ledger-ex-staff-phished-in-library-compromise-tbt73738.html</a></p>

Ledger ex-staff phished in library compromise

TheBitTimes

Other articles published on Dec 14, 2023

Mortal Kombat 1 Update Sparks Mixed Reactions

Bitget Wallet Partners Up with Linea, Aims to Collaboratively Develop the Layer 2 Ecosystem (14 Dec)

Solana May Surpass XRP and Enter the Top 5 Cryptos With This Move—Should BinanceCoin Be Concerned?

Beyond Bitcoin: Exploring the Potential of VC Spectra and The Sandbox as Alternatives

Shiba Inu Price Rallies As Shytoshi Kusama Lauds Major SHIB Listing

The Rise of Unified Payment Infrastructures: Simplifying Settlements, Streamlining Operations

Join our free newsletter for daily crypto updates!