Breaking NEWS: Ledge Hack A Possible Inside Job
The crypto currency's sector has recently been shaken by a series of supply chain attacks targeting Ledger a leading hardware wallet provider. Malicious code infiltrated Ledger's ConnectKit which is a critical piece of code facilitating the connection between blockchain applications and Ledger devices.
This breach has raised concerns about the security of crypto web apps and the potential loss of funds for unsuspecting users. If you’re a ledger user you’re advised to check your assets and ensure that they are safe. Users are also advised to not engage with any dApps until the new patch is announced to rectify the malicious code
What is Ledgers and ConnectKit
Ledger is a well known and utilised hardware wallet which is designed to securely store digital assets offline and providing users with a robust solution for managing their crypto currencies including Bitcoin and Ethereum.
The Ledger ConnectKit is a vital library that enables web3 applications to connect seamlessly with Ledger hardware wallets. This integration is crucial for decentralised finance (De-Fi) protocols and various crypto applications that rely on Ledger's hardware for secure transactions.
According to ledger six million people have purchased their hardware units while 1.5 million people have purchased their software version Ledger’s software enables web3 dApps to connect to it’s services enabling users the ability to transfer crypto currency across multiple platforms.
The recent attacks on Ledger's ConnectKit involved the insertion of a malicious code into the Github library for Connect Kit.
This exploit led to the theft of substantial amounts of crypto currency with reports indicating losses being reported differentiating amounts of stolen funds ranging from USD 150,000, USD 484,000 and even up to USD 680,000.
The attackers targeted vulnerabilities in versions 1.1.5 through 1.1.7 of the ConnectKit injecting a rogue WalletConnect project to reroute funds to their control. Once they had access they were able to quickly access and shift people’s funds to their own accounts landing them one of the most intricate and successful hacks covering multiple projects to date.
This showcases the dangers and infancy of the current sector which still has a long way to go to enable safe systems and that users need to continue to be vigilant to ensure their funds and assets are safe.
Market Impact
Several major De-Fi protocols including Sushi swap, Lido, Metamask and Coinbase were affected by the Ledger supply chain attack. Users were promptly warned to avoid interacting with decentralised applications (dApps) until the protocols using the compromised ConnectKit were updated. The attack emphasised the fragility of decentralised applications revealing potential vulnerabilities along the supply chain that can impact end users.
As Ledge enables cross chain access to many protocols this echos the dangers Vitalik the founder of Ethereum has previously raised in relation to projects and dApps that enable cross chain compatibility. Hacks have the potential to not just harm the person who has been hacked but the broader sector as hackers sell large amounts of assets.
Ledger's Response
Ledger responded swiftly to the supply chain attack acknowledging the breach and removing the malicious version of the ConnectKit.
However, the risk persisted for users of affected protocols until each protocol manually updated its version of the library. Ledger advised users to avoid interaction with any dApps until they could confirm the migration to a secure version of the ConnectKit. Ongoing phishing attacks were also reported and users are being urged to remain vigilant against potential threats.
The Ledger supply chain attack serves as a stark reminder of the evolving threats in the crypto space. As the investigation into the incident continues with evidence suggesting it was an inside job
It is essential for the crypto community to learn from this breach and implement robust security measures. Ledger, despite previous security issues emphasises that its core hardware and main software application (Ledger Live) were not compromised directly by this supply chain attack.
This recent supply chain attack on Ledger's ConnectKit has sent shockwaves through the crypto community prompting users to exercise caution and be vigilant against potential threats.
As the investigation unfolds it is crucial for crypto investors to stay informed about the incident's developments and take necessary precautions.
Ledger's response to the breach highlights the importance of constant vigilance, collaboration within the crypto community and the implementation of stringent security measures to safeguard digital assets.
Image sources provided supplemented by Canva Pro Subscription. This is not financial advice and readers are advised to undertake their own research or seek professional financial services.
Posted Using InLeo Alpha
