Token

Connect

<a href="https://bitcoinworld.co.in/ledger-hardware-wallet-has-been-hacked-about-484000-lost-in-the-heist/" title="Ledger ‘Hardware’ Wallet Has Been Hacked, About $484,000 Lost In The Heist" rel="nofollow"></a>
Hardware wallet provider Ledger was the target of a sophisticated hack incident, which led to the theft of about $484,000 in assets.&nbsp; 
The hack was linked to a former Ledger employee who fell victim to a phishing attack. The hack happened when a former employee was tricked into giving access to their account, allowing the attacker to publish malicious versions of the Ledger Connect Kit. 
About $150,000 was stolen initially, although it was later reported that the money lost had reached about $484,000.&nbsp; 
The malicious code was active for around five hours, but Ledger’s technology and security teams quickly responded and fixed the problem within 40 minutes with the help of WalletConnect and Tether, who also froze the hacker’s wallet. 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 FINAL TIMELINE AND UPDATE TO CUSTOMERS: 
 4:49pm CET: 
 Ledger Connect Kit genuine version 1.1.8 is being propagated now automatically. We recommend waiting 24 hours until using the Ledger Connect Kit again. 
 The investigation continues, here is the timeline of what we know about… 
 — Ledger (@Ledger) <a href="https://twitter.com/Ledger/status/1735326240658100414?ref_src=twsrc%5Etfw">December 14, 2023</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
Despite the rapid response, it was believed the window for fund drainage was less than two hours. 
Ledger since coordinated with WalletConnect to disable the rogue project and propagated the genuine and verified Ledger Connect Kit version 1.1.8, which was now considered safe for use. 
See Also: <a class="row-title" href="https://bitcoinworld.co.in/fake-ledger-live-application-steals-588k-from-microsoft-store/" aria-label="“Fake Ledger Live Application Steals $588K From Microsoft Store” (Edit)">Fake Ledger Live Application Steals $588K From Microsoft Store</a> 
To bolster security, the connect-kit development team on the NPM project was set to read-only mode, preventing direct pushes of the NPM package. 
Ledger also internally rotated the secrets to publish on its GitHub and developers were urged to ensure they were using the latest version, 1.1.8. 
The severity of the attack was highlighted by the substantial amount stolen, with the hacker transferring approximately 4.334 ETH to an address known as “AngelDrainer,” which currently holds assets worth around $363,000. 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 A hacker attacked <a href="https://twitter.com/hashtag/Ledger?src=hash&amp;ref_src=twsrc%5Etfw">#Ledger</a> and has stolen ~$484K assets.<a href="https://twitter.com/hashtag/LedgerExploiter?src=hash&amp;ref_src=twsrc%5Etfw">#LedgerExploiter</a> transferred 4.334 <a href="https://twitter.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$ETH</a> to <a href="https://twitter.com/hashtag/AngelDrainer?src=hash&amp;ref_src=twsrc%5Etfw">#AngelDrainer</a>. 
 And the <a href="https://twitter.com/hashtag/AngelDrainer?src=hash&amp;ref_src=twsrc%5Etfw">#AngelDrainer</a> is also receiving assets currently and holds $363K assets.<a href="https://t.co/ZG5SRlKBjW">https://t.co/ZG5SRlKBjW</a> <a href="https://t.co/RK9aPyAjEE">pic.twitter.com/RK9aPyAjEE</a> 
 — Lookonchain (@lookonchain) <a href="https://twitter.com/lookonchain/status/1735309710356877615?ref_src=twsrc%5Etfw">December 14, 2023</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
In response to this, Ledger, along with partners such as WalletConnect, reported the bad actor’s wallet address, now visible on Chainalysis. 
Tether took <a href="https://x.com/paoloardoino/status/1735315976827101274?s=20">action</a> by freezing the bad actor’s assets, showcasing the collaborative efforts within the cryptocurrency community to address such security breaches. 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 Tether just froze the Ledger exploiter address 
 — Paolo Ardoino <img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f350.png" alt="🍐" class="wp-smiley" style="height: 1em; max-height: 1em;"> (@paoloardoino) <a href="https://twitter.com/paoloardoino/status/1735315976827101274?ref_src=twsrc%5Etfw">December 14, 2023</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
The company reiterated the importance of using the Clear Sign feature on Ledger devices to ensure transaction authenticity and advised customers to wait 24 hours before using the Ledger Connect Kit again, as a precautionary measure. 
Ledger also urged them to pause their hardware wallet interactions with decentralized applications (DApps). 
See Also: <a class="row-title" href="https://bitcoinworld.co.in/rainbow-wallet-token-aims-at-taking-advantage-of-metamask/" aria-label="“Rainbow Wallet Token Aims At Taking Advantage Of MetaMask” (Edit)">Rainbow Wallet Token Aims At Taking Advantage Of MetaMask</a> 
In a new thread on the social media platform X, Ledger says that it has found, identified, and replaced a malicious version of its connect kit, a piece of code used to connect hardware wallets to DApps. 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 <img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;">We have identified and removed a malicious version of the Ledger Connect Kit. <img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"> 
 A genuine version is being pushed to replace the malicious file now. Do not interact with any dApps for the moment. We will keep you informed as the situation evolves. 
 Your Ledger device and… 
 — Ledger (@Ledger) <a href="https://twitter.com/Ledger/status/1735291427100455293?ref_src=twsrc%5Etfw">December 14, 2023</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
“We have identified and removed a malicious version of the Ledger Connect Kit. A genuine version is being pushed to replace the malicious file now. Do not interact with any DApps for the moment. We will keep you informed as the situation evolves. Your Ledger device and Ledger Live were not compromised.” 
The post <a href="https://bitcoinworld.co.in/ledger-hardware-wallet-has-been-hacked-about-484000-lost-in-the-heist/">Ledger ‘Hardware’ Wallet Has Been Hacked, About $484,000 Lost In The Heist</a> appeared first on <a href="https://bitcoinworld.co.in">BitcoinWorld</a>.

Ledger ‘Hardware’ Wallet Has Been Hacked, About $484,000 Lost In The Heist

ItsBitcoinWorld

Other articles published on Dec 15, 2023

Matrixport Predicts Bitcoin 2024 Surge, Regardless Of Spot ETF Approval – Here’s Why

Binance Futures Introduces 1000RATS Perpetual Contract with 50x Leverage

Unveiling Tactics: Ledger Connect Hacker’s Ingenious Exploits Revealed

3 Reasons Why XRP Is Underperforming in This Rally

SHIB vs TON: The Battle for the 15th Spot in Market Cap

Elon Musk’s AI Chatbot Grok and Grimes’ AI Toy Open to Friendship Amid Custody Battle

Join our free newsletter for daily crypto updates!