Bitcoin

Litecoin

Namecoin

<p>Hardware wallet manufacturer Ledger recently discovered a malicious <a href="https://developers.ledger.com/docs/connectivity/connect-kit" rel="noopener noreferrer nofollow">version of its Connect Kit</a>, which has prompted a warning to users against connecting to decentralized applications (dapps). With this article, we will go into the details of the incident, highlighting the potential risks and providing insights from industry experts. Let’s get into it!</p><blockquote>— Ledger (&#64;Ledger) <a href="https://twitter.com/Ledger/status/1735291427100455293?ref_src&#61;twsrc%5Etfw" rel="noopener noreferrer nofollow">December 14, 2023</a>&#x1f6a8;We have identified and removed a malicious version of the Ledger Connect Kit. &#x1f6a8;A genuine version is being pushed to replace the malicious file now. Do not interact with any dApps for the moment. We will keep you informed as the situation evolves. Your Ledger device and…</blockquote><h2 id="header-0">Malicious Version Identified</h2><p>Ledger has identified and removed a malicious version of its Connect Kit, a library that facilitates the interaction between Ledger hardware wallets and dapps. Users are advised not to engage with any dapps until the situation is resolved. Ledger assures users that its devices and <a href="https://www.ledger.com/ledger-live" rel="noopener noreferrer nofollow">Ledger Live app</a> remain uncompromised, and they will provide updates as the situation evolves.</p><p><img src="https://academy-public.coinmarketcap.com/optimized-uploads/ea9810ced15e48689aa708d62fe433eb.gif" /></p><h2 id="header-1">Impact on Dapps</h2><p>Developers on Twitter initially reported the compromised version of the Connect Kit. Web3 <a href="https://twitter.com/blockaid_/status/1735275569586090221?ref_src&#61;twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1735275569586090221%7Ctwgr%5Ef89bfcc36912a8c6a857abbaee5bafcd69127878%7Ctwcon%5Es1_&amp;ref_url&#61;https%3A%2F%2Fdecrypt.co%2F209804%2Fledger-library-compromised-with-wallet-drainer" rel="noopener noreferrer nofollow">security firm BlockAid confirmed</a> that dapps using versions 1.1.4 and above of Ledger’s Connect Kit, including Sushi.com and Hey.xyz, were affected. The attacker injected a wallet-draining payload into the compromised library, posing a significant risk to users’ funds.</p><h2 id="header-2">Criticism and Recommendations</h2><p>SushiSwap CTO Matthew Lilley <a href="https://twitter.com/MatthewLilley/status/1735285684070461534?s&#61;20" rel="noopener noreferrer nofollow">criticized Ledger for the security</a> breach, emphasizing the need for dapp teams to confirm mitigation measures before resuming usage. Ethereum core developer liaison Hudson Jameson highlighted the risks of using dapps without understanding the backend libraries they rely on. Even after Ledger addresses the issue, dapp projects using the compromised library must update their systems for safe usage.</p><blockquote>— I&#39;m Software &#x1f987;&#x1f50a; (&#64;MatthewLilley) <a href="https://twitter.com/MatthewLilley/status/1735275960662921638?ref_src&#61;twsrc%5Etfw" rel="noopener noreferrer nofollow">December 14, 2023</a>&#x1f6a8;&#x1f6a8;&#x1f6a8; RED ALERT &#x1f6a8;&#x1f6a8;&#x1f6a8;: Do not interact with ANY dApps until further notice. It appears that a commonly used web3 connector has been compromised which allows for injection of malicious code affecting numerous dApps.</blockquote><h2 id="header-3">Previous Security Concerns</h2><p>Ledger has faced criticism regarding its security practices in recent times. The voluntary <a href="https://twitter.com/Ledger/status/1658458714771169282?s&#61;20" rel="noopener noreferrer nofollow">ID-based Recover service</a>, unrelated to the current attack, received backlash from users who considered it a potential “backdoor.” The company’s co-founder acknowledged the service’s poor rollout but defended its technical integrity. Additionally, Ledger previously experienced <a href="https://decrypt.co/53961/bitcoin-wallet-ledger-discovers-full-extent-hack" rel="noopener noreferrer nofollow">incidents involving a fraudulent app</a> on the Microsoft App Store and a customer email database breach.</p><p>More Info: <a href="https://hodl.fm/protect-seed-phrase" rel="noopener noreferrer nofollow">How to Protect Your Seed Phrase</a></p><blockquote>— lynk (&#64;lynk0x) <a href="https://twitter.com/lynk0x/status/1658498502157037568?ref_src&#61;twsrc%5Etfw" rel="noopener noreferrer nofollow">May 16, 2023</a>So ledger had access to my seed phrase this whole time? Lol</blockquote><h2 id="header-4">Conclusion</h2><p>The compromise of Ledger’s Connect Kit serves as a reminder of the importance of <a href="https://hodl.fm/how-to-keep-your-crypto-safe-8-tips-to-stay-protected" rel="noopener noreferrer nofollow">maintaining strong security practices</a> in the cryptocurrency space. Users should exercise caution when interacting with dapps until Ledger resolves the issue and dapp teams implement necessary updates.</p><p><strong>P.S. Breaking Down the Ledger Saga: Dive into the Exploit Chronicles</strong></p><p>Yet, in this cyber-age drama, Ledger’s technology and security teams emerge as the unsung heroes, responding to the breach within a remarkable 40 minutes. The malevolent file may have lingered for five hours, but the window of vulnerability, where funds faced potential drainage, appears to have been mercifully brief – less than two hours.</p><p>Collaboration becomes a central theme in this narrative as Ledger coordinates with WalletConnect, swiftly disabling the rogue project. The genuine Ledger Connect Kit version 1.1.8 is subsequently deployed, standing as a testament to the resilience of security measures.</p><p>Behind the code curtain, developers find themselves in read-only mode for safety reasons, while secrets are rotated on Ledger’s GitHub, fortifying the defenses against potential future incursions. A call is issued to developers to ensure they are utilizing the latest version, 1.1.8.</p><p>As the pursuit of justice unfolds, a complaint is filed, and law enforcement joins the investigation to apprehend the malevolent actor. Simultaneously, Ledger, along with partners such as WalletConnect, reports the bad actor’s wallet address, with Tether freezing the associated USDT.</p><p>Here is what the company say</p><blockquote>— Ledger (&#64;Ledger) <a href="https://twitter.com/Ledger/status/1735326240658100414?ref_src&#61;twsrc%5Etfw" rel="noopener noreferrer nofollow">December 14, 2023</a>FINAL TIMELINE AND UPDATE TO CUSTOMERS:4:49pm CET:Ledger Connect Kit genuine version 1.1.8 is being propagated now automatically. We recommend waiting 24 hours until using the Ledger Connect Kit again.The investigation continues, here is the timeline of what we know about…</blockquote><h3 id="more-info">More Info:</h3><ul><li><a href="https://hodl.fm/guide-to-crypto-crime-terminology" rel="noopener noreferrer nofollow">Cheat Sheet for a REAL Crypto Criminal: Your Guide to Crypto Crime Terminology</a></li><li><a href="https://hodl.fm/xrpl-fixreducedoffersv1-upgrade-functionality" rel="noopener noreferrer nofollow">XRPL’s fixReducedOffersV1 Upgrade: Enhancing XRPL Functionality</a></li></ul><p>Ledger’s track record of security concerns warrants scrutiny, highlighting the need for users to stay informed and take proactive measures to protect their crypto assets.</p><p>Disclaimer: <em>All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Please note that despite the nature of much of the material created and hosted on this website, HODL.FM is not a financial reference resource and the opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice of this sort, HODL.FM strongly recommends contacting a qualified industry professional.</em></p>

Ledger’s Connect Kit Compromised: Caution Advised for Dapp Users

Table of Contents

hodl.fm

Other articles published on Dec 18, 2023

Cipher Mining’s Strategic Expansion in the Crypto Mining Industry

5 Coins to Make 20-50X in the Next Bull Run

Cardano Founder Charles Hoskinson Denies Partnership With XRP

Here’s what Bitcoin needs to continue gains into 2024

What is the Solana Saga Phone and Why Bonk Tokens Are So Popular?

Shiba Inu Price Predictions and Current SHIB Chart Comments

Join our free newsletter for daily crypto updates!