Pascal

Connect

<img width="1280" height="853" src="https://coingape.com/wp-content/uploads/2023/12/Pascal.jpg" class="attachment-full size-full wp-post-image" alt="" decoding="async" style="float:right; margin:0 0 10px 10px;" srcset="https://coingape.com/wp-content/uploads/2023/12/Pascal.jpg 1280w, https://coingape.com/wp-content/uploads/2023/12/Pascal-300x200.jpg 300w, https://coingape.com/wp-content/uploads/2023/12/Pascal-1224x816.jpg 1224w, https://coingape.com/wp-content/uploads/2023/12/Pascal-768x512.jpg 768w, https://coingape.com/wp-content/uploads/2023/12/Pascal-150x100.jpg 150w, https://coingape.com/wp-content/uploads/2023/12/Pascal-272x182.jpg 272w" sizes="(max-width: 1280px) 100vw, 1280px">
In light of the recent Ledger Hacking, the Decentralized Finance (DeFi) protocol’s Chairman and CEO, Pascal Gauthier has <a rel="nofollow" href="https://www.ledger.com/blog/a-letter-from-ledger-chairman-ceo-pascal-gauthier-regarding-ledger-connect-kit-exploit" target="_blank">issued a new update</a>. 
<h2 id="strong-ledger-hacking-acknowledged-and-explained-strong">Ledger Hacking Acknowledged and Explained</h2> 
He started by acknowledging the <a href="https://coingape.com/rug-pull-alert-multiple-protocols-affected-in-ledger-connectkit-attack/" target="_blank" rel="noopener">recent exploit</a> which involved the injection of malicious code into the Javascript library. It affected mostly versions greater than 1.1.4, that is, versions 1.1.5, 1.1.6, and 1.1.7.&nbsp; Furthermore, he explained that the hack was as a result of a loophole exploited by the bad actor.&nbsp; 
A former employee fell victim to a phishing attack that eventually provided a bad actor with access to upload a malicious file to Ledger’s NPMJS. This NPMJS is a package manager for Javascript code shared between apps. Ledger swung into action immediately to salvage the situation with support from WalletConnect, its partner. At once, the NPMJS was removed and the malicious file was immediately disabled. 
All these happened within forty minutes of the exploit’s discovery. Gauthier highlighted the alliance as a good reference of the industry working swiftly together to tackle security challenges that plagues the ecosystem.&nbsp; 
<h2 id="strong-hacker-exploit-scare-is-over-strong">Hacker Exploit Scare is Over</h2> 
Ordinarily, no single person has the sole power to deploy codes on Ledger’s ConnectKit as he would require that some other parties review the transaction. At the same time, Gauthier clarified that every employee who leaves the company at any time and for whatever reasons, always has their access to the Ledger systems revoked at once.&nbsp; 
Prior to exiting the company, employees are granted access to controls, internal reviews, and multi-signature code especially, as it has to do with most parts of Ledger’s development.&nbsp;This is prevalent in 90% of the firm’s development. Gauthier suggested that the DeFi protocol had previously imbibed security strategies to protect investors.&nbsp; 
However, the latest attack is a clear proof and reminder that security is not static. Therefore, “Ledger must continuously improve our security systems and processes. In this area, Ledger will implement stronger security controls, connecting our build pipeline that implements strict software supply chain security to the NPM distribution channel.” 
A new version of the Ledger Connect Kit has been <a href="https://coingape.com/ledger-releases-new-connect-kit-version-to-mitigate-hack-impact/" target="_blank" rel="noopener">introduced</a> and users who intend to keep utilizing the tool, are advised to upgrade to this version. Once Ledger Connect Kit version 1.1.8 is installed, users may have to wait for up to 24 hours before activating. So far, it’s looking good plus Gauthier has assured users that the situation is now under control and “the threat has passed.” 
The post <a href="https://coingape.com/ledger-ceo-on-hacking-incident-the-threat-has-passed/">Ledger CEO on Hacking Incident, “The Threat Has Passed”</a> appeared first on <a href="https://coingape.com">CoinGape</a>.

Ledger CEO on Hacking Incident, “The Threat Has Passed”

Table of Contents

Coingape News Media

Other articles published on Dec 14, 2023

CBRC-20: Transforming Token Efficiency on Bitcoin

SafeMoon Files For Chapter 7 Bankruptcy

Top Altcoins Display Bullish Price Action! INJ And STX Price Poised To Record More Gains?

Gensler Dodges Crypto Questions After Treasury Market Meeting

Ledger ConnectKit Library Hacked, Poses Threat to DApps

Binance Survey Unveils Crypto’s Role in Boosting Incomes for Nearly Half of Users

Join our free newsletter for daily crypto updates!