fxs_header_sponsor_anchor

Ledger attack details and new findings

|ByLockridge Okoth

  • Ledger has confirmed that multiple dApps on its connector library have been hacked and replaced with a drainer.
  • Among the victims, SushiSwap, whose CTO placed blame on Ledger’s content delivery system.
  • Users have been asked to wait out interacting with any dApps until things become clearer.

New findings from the Ledger dApps attack show that the exploiter may have left their email address behind.

Also, blockchain detective Lookonchain reports that the attacker made away with just about $484,000 worth of assets, and that they moved 4.334 ETH to the drainer address.

Tether CTO Paolo Ardoino says "Tether just froze the Ledger exploiter address," while Crypto Banter's Ran Neuner urges users to shun interacting "with DeFi at all today! [as] No app is safe regardless of whether you use a Ledger."

The following section was published shortly after the attack

Ledger is the latest victim of a hacking incident after multiple decentralized applications (dApps) on its connector library were hacked. The exploiter inserted a wallet drainer account address through the vulnerable code. Among the affected dApps were SushiSwap, Revoke.cash, Zapper and Balancer.

Ledger has confirmed the vulnerability in its code, confirming having truncated a malicious version of the Ledger Connect Kit, with efforts to put a genuine version already underway. 

According to DAppsOn-chain analysts, the connect-kit-loader as well as every other dApp that uses LedgerHQ/connect-kit, is vulnerable and should not be used, acknowledging that this is a large-scale attack on multiple dApps.

SushiSwap’s Chief Technical Officer, Mathew Lilley, explained that the attack allowed the injection of malicious code. Nevertheless, Sushi has confirmed working to remove the ledger wallet connector but asks users to “refrain from engaging with any dApps until further notice.”

Besides the bold assertion, Lilley blames Ledger for the attack, citing multiple blunders after Ledger’s content delivery system (CDN) was compromised. According to the CTO, Ledger first loaded java script from a compromised CDN before version-locking loaded java script.

With the addition of a drainer address, funds may not leave the user's account unless they react to prompts from a browser wallet. This could give the exploiter access to the user’s account. Users are therefore urged not to interact with untrusted prompts until the situation is resolved.

According to Polygon Labs Vice President, Hudson Jameson, the intervention by Ledger to remove the malicious version of the Ledger Connect Kit is not enough, adding that projects that use that library should update things on their own end prior to using dApps that leverage Ledger’s Web3 libraries.

Ledger did not immediately respond to FXStreet team's request for comment.  

Information on these pages contains forward-looking statements that involve risks and uncertainties. Markets and instruments profiled on this page are for informational purposes only and should not in any way come across as a recommendation to buy or sell in these assets. You should do your own thorough research before making any investment decisions. FXStreet does not in any way guarantee that this information is free from mistakes, errors, or material misstatements. It also does not guarantee that this information is of a timely nature. Investing in Open Markets involves a great deal of risk, including the loss of all or a portion of your investment, as well as emotional distress. All risks, losses and costs associated with investing, including total loss of principal, are your responsibility. The views and opinions expressed in this article are those of the authors and do not necessarily reflect the official policy or position of FXStreet nor its advertisers.

RELATED CONTENT

Loading ...

Copyright © 2024 FOREXSTREET S.L., All rights reserved.