Solana

In yet another significant security breach, unknown malicious agents targeted Ledger, the popular hardware wallet provider, aiming to exploit their LedgerConnect kit. Blockaid, a platform aiming to protect web3 users, was the first to report on the attack. 
<h2 id="the-supply-chain-attack-targeting-ledger-connector">The Supply Chain Attack Targeting Ledger Connector</h2> 
Taking to X on December 14, Blockaid&nbsp;<a class="editor-rtfLink" href="https://twitter.com/blockaid_/status/1735275569586090221?s=20" target="_blank" rel="noopener nofollow">said</a>&nbsp;attackers successfully injected a “wallet-draining payload” into the NPM package. Once the payload propagated, attackers hijacked the front end of multiple apps, including Sushi, Hey, and Zapper, crippling operations and reportedly making away with hundreds of thousands of dollars worth of assets.&nbsp; 
The attack wasn’t targeting any dapp or blockchain like Solana or Ethereum, for example. Instead, hackers wanted to exploit all protocols whose users, in one way or another, used the LedgerConnect kit to manage or transfer assets.&nbsp; <a href="https://www.tradingview.com/x/rBv9n0c1/" rel="nofollow noopener" target="_blank"><img loading="lazy" decoding="async" class="size-full" src="https://www.tradingview.com/x/rBv9n0c1/" alt="Solana price trending upward on the daily chart | Source: SOLUSDT on Binance, TradingView" width="1233" height="592"></a> 
To understand how the hack was executed, hackers expressly targeted Ledger’s NPM. The connector is crucial in how typically off-chain Ledger wallet clients can securely connect and manage their assets online.&nbsp; 
While providing a means of accessing wallets, NPM is also an interface. Through this portal, developers can integrate Ledger hardware wallets into apps. In this case, Ledger users can securely engage in non-fungible tokens (NFTs), decentralized finance (DeFi), and other activities.&nbsp; 
Since this attack aimed to exploit a critical Ledger infrastructure that could impact all protocols regardless of blockchain, analysts now say these agents successfully executed a “supply chain attack.” In supply chain attacks on DeFi protocols, hackers can target a trusted service provider, mostly a wallet provider or exchange, to steal funds. 
<h2 id="ledger-responds-over-480-000-stolen">Ledger Responds, Over $480,000 Stolen</h2> 
Wintermute’s Head of Research, Igor Igamberdiev, reported that a script infected with malware was uploaded to Ledger’s NPM register at 9:44 am UTC. However, Ledger has since&nbsp;<a class="editor-rtfLink" href="https://twitter.com/Ledger/status/1735298142118072512" target="_blank" rel="noopener nofollow">responded</a>, saying they deleted the malicious file and replaced it with a genuine version roughly four hours after the script was uploaded at around 1:35 pm UTC.&nbsp; 
Ledger has also reminded users to be keen before signing off on their transactions, emphasizing that all addresses and information displayed on their interface are the “only reliable sources of information.” Earlier, the hardware manufacturer assured clients that their devices were not compromised. 
Despite these assurances, Lookonchain, a blockchain analytics platform,&nbsp;<a class="editor-rtfLink" href="https://twitter.com/lookonchain/status/1735309710356877615" target="_blank" rel="noopener nofollow">said</a>&nbsp;over $480,000 worth of assets were stolen before Ledger patched the error. 
<img loading="lazy" decoding="async" class="size-full wp-image-269605" src="https://bitcoinist.com/wp-content/uploads/2023/12/GBUOatsakAASJIK.jpg?resize=1024%2C732" alt="Assets stolen from the Ledger attack | Source: Lookonchain on X" width="1024" height="732" srcset="https://bitcoinist.com/wp-content/uploads/2023/12/GBUOatsakAASJIK.jpg?resize=1024%2C732?w=1572 1572w, https://bitcoinist.com/wp-content/uploads/2023/12/GBUOatsakAASJIK.jpg?resize=1024%2C732?w=587 587w, https://bitcoinist.com/wp-content/uploads/2023/12/GBUOatsakAASJIK.jpg?resize=1024%2C732?w=768 768w, https://bitcoinist.com/wp-content/uploads/2023/12/GBUOatsakAASJIK.jpg?resize=1024%2C732?w=923 923w, https://bitcoinist.com/wp-content/uploads/2023/12/GBUOatsakAASJIK.jpg?resize=1024%2C732?w=1536 1536w, https://bitcoinist.com/wp-content/uploads/2023/12/GBUOatsakAASJIK.jpg?resize=1024%2C732?w=120 120w, https://bitcoinist.com/wp-content/uploads/2023/12/GBUOatsakAASJIK.jpg?resize=1024%2C732?w=350 350w, https://bitcoinist.com/wp-content/uploads/2023/12/GBUOatsakAASJIK.jpg?resize=1024%2C732?w=750 750w, https://bitcoinist.com/wp-content/uploads/2023/12/GBUOatsakAASJIK.jpg?resize=1024%2C732?w=1140 1140w" sizes="(max-width: 1000px) 100vw, 1000px" data-recalc-dims="1"> 
To further reinforce ZachXBT’s statement, Paolo Ardoino, the CEO of Tether, the USDT issuer,&nbsp;<a class="editor-rtfLink" href="https://twitter.com/paoloardoino/status/1735315976827101274" target="_blank" rel="noopener nofollow">took</a>&nbsp;to X, saying the platform had blocked the Ledger Exploiter’s address.

Ledger Falls Victim To Supply Chain Attack, Over $480,000 Drained

Table of Contents

Bitcoinist

Other articles published on Dec 15, 2023

McDonald’s and Google Collaborate to Integrate AI in Growth Plans

Ethereum “Piece of Junk” When Compared to Bitcoin, Says Peter Brandt

Bitget’s 2024 Bitcoin Report: ORDI’s High Potential and Lightning Network’s Crucial Role

SHIB weekly close above this level could catapult bullish breakout

Infura Launches Unified Key Experience for Enhanced Simplicity and Security

Solana CEO to reinvest $1b, traders accumulating ApeCoin and Everlodge

Join our free newsletter for daily crypto updates!