• Ledger has confirmed that multiple dApps on its connector library have been hacked and replaced with a drainer.
  • Among the victims, SushiSwap, whose CTO placed blame on Ledger’s content delivery system.
  • Users have been asked to wait out interacting with any dApps until things become clearer.

New findings from the Ledger dApps attack show that the exploiter may have left their email address behind.

Also, blockchain detective Lookonchain reports that the attacker made away with just about $484,000 worth of assets, and that they moved 4.334 ETH to the drainer address.

Tether CTO Paolo Ardoino says "Tether just froze the Ledger exploiter address," while Crypto Banter's Ran Neuner urges users to shun interacting "with DeFi at all today! [as] No app is safe regardless of whether you use a Ledger."

The following section was published shortly after the attack

Ledger is the latest victim of a hacking incident after multiple decentralized applications (dApps) on its connector library were hacked. The exploiter inserted a wallet drainer account address through the vulnerable code. Among the affected dApps were SushiSwap, Revoke.cash, Zapper and Balancer.

Ledger has confirmed the vulnerability in its code, confirming having truncated a malicious version of the Ledger Connect Kit, with efforts to put a genuine version already underway. 

According to DAppsOn-chain analysts, the connect-kit-loader as well as every other dApp that uses LedgerHQ/connect-kit, is vulnerable and should not be used, acknowledging that this is a large-scale attack on multiple dApps.

SushiSwap’s Chief Technical Officer, Mathew Lilley, explained that the attack allowed the injection of malicious code. Nevertheless, Sushi has confirmed working to remove the ledger wallet connector but asks users to “refrain from engaging with any dApps until further notice.”

Besides the bold assertion, Lilley blames Ledger for the attack, citing multiple blunders after Ledger’s content delivery system (CDN) was compromised. According to the CTO, Ledger first loaded java script from a compromised CDN before version-locking loaded java script.

With the addition of a drainer address, funds may not leave the user's account unless they react to prompts from a browser wallet. This could give the exploiter access to the user’s account. Users are therefore urged not to interact with untrusted prompts until the situation is resolved.

According to Polygon Labs Vice President, Hudson Jameson, the intervention by Ledger to remove the malicious version of the Ledger Connect Kit is not enough, adding that projects that use that library should update things on their own end prior to using dApps that leverage Ledger’s Web3 libraries.

Ledger did not immediately respond to FXStreet team's request for comment.  


Information on these pages contains forward-looking statements that involve risks and uncertainties. Markets and instruments profiled on this page are for informational purposes only and should not in any way come across as a recommendation to buy or sell in these assets. You should do your own thorough research before making any investment decisions. FXStreet does not in any way guarantee that this information is free from mistakes, errors, or material misstatements. It also does not guarantee that this information is of a timely nature. Investing in Open Markets involves a great deal of risk, including the loss of all or a portion of your investment, as well as emotional distress. All risks, losses and costs associated with investing, including total loss of principal, are your responsibility. The views and opinions expressed in this article are those of the authors and do not necessarily reflect the official policy or position of FXStreet nor its advertisers. The author will not be held responsible for information that is found at the end of links posted on this page.

If not otherwise explicitly mentioned in the body of the article, at the time of writing, the author has no position in any stock mentioned in this article and no business relationship with any company mentioned. The author has not received compensation for writing this article, other than from FXStreet.

FXStreet and the author do not provide personalized recommendations. The author makes no representations as to the accuracy, completeness, or suitability of this information. FXStreet and the author will not be liable for any errors, omissions or any losses, injuries or damages arising from this information and its display or use. Errors and omissions excepted.

The author and FXStreet are not registered investment advisors and nothing in this article is intended to be investment advice.

Recommended content


Recommended Content

Editors’ Picks

Top 3 Price Prediction Bitcoin, Ethereum, Ripple: BTC & ETH rebound, XRP rallies ahead of CPI data

Top 3 Price Prediction Bitcoin, Ethereum, Ripple: BTC & ETH rebound, XRP rallies ahead of CPI data

Bitcoin and Ethereum prices continue to recover on Wednesday after finding support around their key levels this week. On the other hand, Ripple remains strong and found support around its upper symmetrical triangle boundary.

More Cryptocurrencies News
Ripple donates $100,000 to California wildfire relief efforts; XRP investors anticipate SEC's opening brief

Ripple donates $100,000 to California wildfire relief efforts; XRP investors anticipate SEC's opening brief

Ripple is up 5% on Tuesday following recent positive developments surrounding its ecosystem and JP Morgan's prediction of over $8 billion in inflows into XRP ETF if it gains approval from the Securities and Exchange Commission.

More Ripple News
Bitcoin could lose its diversification status as correlation with stocks increases

Bitcoin could lose its diversification status as correlation with stocks increases

Bitcoin's rising correlation with the traditional stock market is gradually affecting its role as a portfolio diversifier. This trend has been visible following Bitcoin's similar reactions to the S&P 500 upon macroeconomic data releases.

More Bitcoin News
Crypto Today: BTC taps $97K, DOGE and XRP in green as SEC sues Musk ahead of Trump Inauguration

Crypto Today: BTC taps $97K, DOGE and XRP in green as SEC sues Musk ahead of Trump Inauguration

The cryptocurrency sector rose by 2.4% on January 14, with the aggregate market capitalization crossing $3.3 trillion. Bitcoin price reclaimed the $97,000 resistance level, with technicals signaling upside ahead. 

More Cryptocurrencies News
Bitcoin: Room for a recovery or continuation of the pullback?

Bitcoin: Room for a recovery or continuation of the pullback?

Bitcoin’s price slightly recovers and trades around $94,700 on Friday after declining nearly 6% earlier this week. US Bitcoin spot Exchange Traded Funds data shows signs of mild recovery, with a total net inflow of $462.2 million until Thursday.

Read full analysis
Best Forex Brokers with Low Spreads

Best Forex Brokers with Low Spreads

VERIFIED Low spreads are crucial for reducing trading costs. Explore top Forex brokers offering competitive spreads and high leverage. Compare options for EUR/USD, GBP/USD, USD/JPY, and Gold.

Read More

BTC

ETH

XRP