Ledger ConnectKit fell victim to a <a href="https://optimisus.com/news/crypto-news/insomniac-games-faces-cyberattack-ransom-demands-over-2-million-in-bitcoin/" rel="noopener noreferrer nofollow">supply chain attack</a>, resulting in a significant security compromise known as a "rug-pull."  
The vulnerability allows the injection of malicious code into various decentralized applications (dApps), posing a considerable threat to users and their assets.  
Web3 security firm Blockaid identified LedgerHQ’s ConnectKit, particularly versions beyond 1.1.4, as the compromised package in this attack.  
According to Ledger, the incident occurred when a former employee's NPMJS account was compromised due to a phishing attempt earlier today.  
The malicious code, redirected to a hacker's wallet using a rogue WalletConnect project, is under investigation. Ledger has pledged to collaborate with law enforcement and file a formal complaint to identify and apprehend the perpetrator.  
The supply chain <a href="https://optimisus.com/news/crypto-news/over-400000-stolen-from-okx-dex-in-a-security-breach/" rel="noopener noreferrer nofollow">attack</a> on Ledger ConnectKit had repercussions across multiple DeFi protocols. Kyber, SushiSwap, RevokeCash, and Zapper were identified as vulnerable decentralized exchanges by Blockaid.  
In response to the threat, Kyber and RevokeCash immediately deactivated their front ends. This vulnerability was discovered shortly after KyberSwap was hacked, resulting in the loss of around $46 million in crypto.  
Blockaid estimates that nearly $150,000 was lost within a few hours, emphasizing the attack's rapid and widespread impact.  
While Blockaid assured users that its wallets were secure, the consequences of the hack could be detrimental to the broader Web3 ecosystem.  
The compromised Ledger ConnectKit software library was hosted on a specific Content Delivery Network (CDN), which was where the vulnerability was discovered.  
Ledger acknowledged the breach and assured customers that a legitimate version of the Ledger ConnectKit would be distributed to replace the malicious file.  
A software patch has been developed in response to the attack to address the identified issue. The incident highlights the challenges and risks associated with supply chain attacks in the decentralized space, emphasizing the importance of increased vigilance and security measures. 
The post <a href="https://optimisus.com/news/crypto-news/defi-community-shocked-by-supply-chain-attack-on-ledger-connectkit/" rel="noopener noreferrer nofollow">DeFi Community Shocked by Supply Chain Attack on Ledger ConnectKit</a> appeared first on <a href="https://optimisus.com" rel="noopener noreferrer nofollow">Optimisus</a>.

DeFi Community Shocked by Supply Chain Attack on Ledger ConnectKit

Optimisus

Other articles published on Dec 15, 2023

Government Report Raises Alarm Over AI’s Potential Threat to Financial Stability

24 Crypto Update, 14 Dec: Sizzling BONK Takes Center Stage in Rally

Bitget Announces Listing of TonUP on Launchpad

Bitcoin Rewards Platform Lolli Raises $8M In Series B Funding To Scale Enterprise Offering

SafeMoon Files For Chapter 7 Bankruptcy

Wikipedia Co-Founder’s Controversial Bitcoin Comments Spark Debate in Cryptocurrency Community

Join our free newsletter for daily crypto updates!