Connect

Security

<p>The post <a href="https://coinpedia.org/news/behind-the-scenes-heres-how-the-ledger-connect-hacker-fooled-users/">Behind the Scenes: Here’s How the Ledger Connect Hacker Fooled Users!&nbsp;</a> appeared first on <a href="https://coinpedia.org">Coinpedia Fintech News</a></p> 
<p>Every week crypto is facing a hacker shock and if you evaluate the recent incidents all the activities were done professionally. The Ledger connect breach adds to a list of high-profile incidents – DOJ’s $25 million crypto AI scam indictment, OKX’s $2.7 million hack, Bitcoin’s security flaw in the National Vulnerability Database, Uranium Finance’s laundering concerns, two crypto provisions axed from the 2024 NDAA, and Poloniex under the U.K. regulator’s scrutiny all are hacking incidents, raising FUD in the market. The industry’s facing quite a storm!&nbsp;</p> 
<h2 class="wp-block-heading" id="h-cracking-down-the-attacker-s-hack-strategy"><strong>Cracking down the Attacker’s Hack Strategy</strong></h2> 
<p>Yesterday we <a href="https://coinpedia.org/news/cautionary-alert-from-sushis-cto-potential-exploit-threat-in-defi-protocol/"><strong>reported </strong></a>how the crypto sector faced a serious setback as the ‘Ledger hacker’ executed a sophisticated exploit, infiltrating Web3 applications like Zapper, SushiSwap, and more. The breach resulted in the siphoning of around $484,000 from unsuspecting users who fell prey to deceptive transaction approvals. The incident is shocking for millions of crypto investors and raises grave doubts about blockchain’s efficiency in dealing with hackers.&nbsp;</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr"><img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;">We have identified and removed a malicious version of the Ledger Connect Kit. <img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"><br><br>A genuine version is being pushed to replace the malicious file now. Do not interact with any dApps for the moment. We will keep you informed as the situation evolves. <br><br>Your Ledger device and…</p>— Ledger (@Ledger) <a href="https://twitter.com/Ledger/status/1735291427100455293?ref_src=twsrc%5Etfw">December 14, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>In an interview with Cointelegraph, Cyvers CEO Deddy Lavid, chief technology officer Meir Dolev, and blockchain analyst Hakal Unal, shed light on the attacker’s unique style. They explained that the hacker manipulated users’ wallets, deceiving them into confirming malicious transactions. The breach was detected between apps and users’ wallets through a compromised connect kit.&nbsp;</p> 
<p>As of today, further insights have emerged into the attack’s workings. The attacker exploited a phishing exploit, gaining entry into a former Ledger employee’s computer and subsequently compromising Ledger Connect’s GitHub repository. Further, they injected malicious code into the repository, which was then circulated to various Web3 apps, affecting their millions of users.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">It sounds like today's security incident was the culmination of 3 separate failures at Ledger:<br><br>1. Blindly loading code without pinning a specific version and checksum.<br>2. Not enforcing "2 man rules" around code review and deployment.<br>3. Not revoking former employee access.</p>— Jameson Lopp (@lopp) <a href="https://twitter.com/lopp/status/1735353894409052227?ref_src=twsrc%5Etfw">December 14, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>With immediate effect, the injected code created misleading transaction confirmations in users’ wallets, prompting them to approve substantial token transfers unknowingly. This strategy, employing confusing or unfamiliar codes, led users to authorize these transactions inadvertently. The impact mainly affects the front end of websites, not hot wallets. They also affected users including revoke. cash who was prompted to link their wallets to a malicious token drainer, expanding the hack’s potential to include all user assets.</p> 
<h2 class="wp-block-heading" id="h-urgent-call-for-strengthened-security"><strong>Urgent Call for Strengthened Security</strong></h2> 
<p>However, Cyvers emphasized the challenges in preventing such attacks due to the lack of clear transaction details in users’ wallets. Despite their platform’s ability to identify contract addresses involved in security incidents, the complexity of these attacks remains a concern.</p> 
<p>The incident underscores the crypto industry’s need for enhanced detection and prevention tools. It highlights the current vulnerabilities within the system, signaling the importance of robust security measures to safeguard users from sophisticated cyber threats.</p>

Behind the Scenes: Here’s How the Ledger Connect Hacker Fooled Users!

Table of Contents

CoinPedia News

Other articles published on Dec 15, 2023

Hong Kong mobile network provider launches NFT marketplace

Analysis of Key Cryptocurrency Support Levels and Chart Reviews

WuBlockchain Weekly: Ordinals Added to Vulnerability Database, Panic Ensues After Ledgerconnect A...

Moderna Shares Jump 12% After Cancer Vaccine Shows Positive Results

SafeMoon files for bankruptcy amid fraud charges, executives arrested

Shiba Inu: New records on Shibarum, 105 million transactions!

Join our free newsletter for daily crypto updates!