Pascal

Connect

<div class="cryptonews">
 <p class="is-style-lead">Ledger announced that it had completely removed the <a rel="noopener noreferrer nofollow" title="exploit" href="https://thebittimes.com/tag/exploit.html">exploit</a> and replaced the hacked library.</p>
 <p>Ledger team noted that it had successfully replaced the hacked library with a fixed one. The malicious code has allegedly been deactivated, and the Ledger Connect Kit is now safe to use.</p>
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
  <div class="wp-block-embed__wrapper">
   <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
    <p lang="en" dir="ltr">UPDATE: The genuine Ledger Connect Kit 1.1.8 is now fully propagated. Ledger and WalletConnect can confirm that the malicious code was deactivated. You are now safe to use your Ledger Connect Kit. Reminder that that we always encourage clear signing.</p>— Ledger (@Ledger) December 14, 2023
   </blockquote>
  </div>
 </figure>
 <p>However, Ledger users doubted the words of the project team about the complete security of wallets. One of the subscribers drew attention to the fact that malicious code could remain in the cache. The <a rel="noopener noreferrer nofollow" title="company" href="https://thebittimes.com/tag/company.html">company</a> recommended waiting a while and clearing the cache in the browser.</p>
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
  <div class="wp-block-embed__wrapper">
   <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
    <p lang="en" dir="ltr">Careful love, this message is likely for developers but retail users will think you're saying it's safe to use their Ledger right now, but it is not.<br><br>If users visited a site this morning (even without making a tx) its still possible for that site's front end to be cached in…</p>— artchick.eth (@digitalartchick) December 14, 2023
   </blockquote>
  </div>
 </figure>
 <p>Ledger CEO Pascal Gauthier noted that the reason for the hack lies in a targeted attack on one of the former employees.</p>
 <blockquote class="wp-block-quote">
  <p>“This <a rel="noopener noreferrer nofollow" title="exploit" href="https://thebittimes.com/tag/exploit.html">exploit</a> was the result of a former employee falling victim to a phishing attack, which allowed a bad actor to upload a malicious file to Ledger’s NPMJS (a package manager for Javascript code shared between apps).”</p> <cite>Pascal Gauthier, Ledger CEO </cite>
 </blockquote>
 <p>Gauthier said Ledger and the <a rel="noopener noreferrer nofollow" title="company" href="https://thebittimes.com/tag/company.html">company</a>’s partner WalletConnect worked together to update the software and fix the <a rel="noopener noreferrer nofollow" title="exploit" href="https://thebittimes.com/tag/exploit.html">exploit</a> within 40 minutes of its discovery. The <a rel="noopener noreferrer nofollow" title="company" href="https://thebittimes.com/tag/company.html">company</a>’s CEO called the incident an “unfortunate isolated incident.” He promised that the <a rel="noopener noreferrer nofollow" title="company" href="https://thebittimes.com/tag/company.html">company</a> would strengthen security measures.</p>
 <p>On Dec. 14, 2023 hackers had attacked Ledger Connect. This is a software library that allows developers to connect decentralized applications (dApps) to Ledger wallets. By compromising Ledger Connect, hackers were able to inject malicious code into dApps that wallet owners can interact with.</p>
 <p>One of the first to draw attention to problems with wallet security was crypto trader Jacob Canfield, who was popular in the crypto community. In his microblog, he shared a piece of code that scammers used to steal money from Ledger owners through Ledger Connect.</p>
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
  <div class="wp-block-embed__wrapper">
   <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
    <p lang="en" dir="ltr">All the dapps that use the Ledger connectivity kits had their code replaced with this. pic.twitter.com/n1lWjp2mm1</p>— Jacob Canfield (@JacobCanfield) December 14, 2023
   </blockquote>
  </div>
 </figure>
 <p>According to the Ledger team, the attack did not affect the Ledger Live application, through which wallet owners conduct transactions with assets. Physical wallets were also not affected.</p>
 <div class="cn-block-related-link">
  <svg class="cn-block-related-link__icon icon" aria-hidden="true"><use xlink:href="#"></use>
  </svg> <span class="cn-block-related-link__prefix"> You might also like: </span> Ledger wallet holders lose $800k to fake app
 </div> <span class="google-news-banner__label">Follow Us on Google News</span>
</div>
<p>Source: <a rel="noopener noreferrer nofollow" target="_blank" href="https://thebittimes.com/ledger-eliminated-exploit-company-s-ceo-comments-on-situation-tbt73788.html">https://thebittimes.com/ledger-eliminated-exploit-company-s-ceo-comments-on-situation-tbt73788.html</a></p>

Ledger eliminated exploit, company’s CEO comments on situation

TheBitTimes

Other articles published on Dec 15, 2023

SafeMoon Bankruptcy: Crypto Tycoon Warned of Scam in 2021

Terra Luna Founder Do Kwon Faces Imminent Extradition Amidst Ongoing Legal Drama

Bitcoin Rewards Platform Lolli Raises $8M In Series B Funding To Scale Enterprise Offering

Ordinals Coin Analysis: Can ORDI Coin Surpass the Current Hurdle?

Healthcare Data Startup Patientory, Inc. Joins Forces with WIVA for Capital Raise

Analysis of Key Cryptocurrency Support Levels and Chart Reviews

Join our free newsletter for daily crypto updates!