BTC

$98106.254

4.76%

ETH

$3358.418

10.11%

BNB

$621.861

2.61%

XRP

$1.206

10.76%

News

Ledger Connect Kit Exploit Still Under Active Investigation

December 15, 2023 - Around 2 mins mins to read
Key Points:
  • Ledger faced a brief security breach on December 14th through its Connect Kit, affecting third-party DApps.
  • The wallet issuer swiftly addressed the Ledger Connect Kit exploit, freezing stolen funds, filing a complaint, and deactivating malicious code within two hours.
  • It plans to enhance security measures, connecting its build pipeline to NPM for continuous improvement in cybersecurity.
In a public letter, Pascal Gauthier, Chairman and CEO of Ledger, addressed a recent security breach involving the Ledger Connect Kit exploit, a Javascript library linking websites to wallets.

Ledger Connect Kit Exploit Still Under Active Investigation

Ledger’s Swift Response to Ledger Connect Kit Exploit

On December 14, hackers exploited the kit, prompting Ledger to swiftly eliminate the vulnerability with its partners. The breach was limited to third-party dApps using the Ledger Connect Kit and is currently under investigation.

Ledger, known for stringent security practices, emphasized that the incident was an isolated case. The company, which filed a complaint, has frozen stolen funds and pledged assistance to affected users in recovering their assets. Ledger is actively cooperating with law enforcement to track and apprehend the perpetrators.

Ledger Takes Proactive Measures After Recent Security Incident

To enhance security measures, Ledger plans to implement stricter controls in its build pipeline, connecting it to the NPM distribution channel. The company emphasized the dynamic nature of security and the need for continuous improvement.

The letter revealed that the Ledger Connect Kit exploit resulted from a former employee falling victim to a phishing attack, allowing the malicious code to run for less than two hours. Ledger promptly released Connect Kit version 1.1.8, deactivating the malicious code in Ledger and WalletConnect. While users are now safe, Ledger recommends waiting 24 hours and clearing the browser cache as a precautionary measure.

DISCLAIMER: The information on this website is provided as general market commentary and does not constitute investment advice. We encourage you to do your own research before investing.

hack

Ledger

Ledger Connect Kit

WalletConnect

Avatar of Harold

Author

Harold

With a passion for untangling the complexities of the financial world, I've spent over four years in financial journalism, covering everything from traditional equities to the cutting edge of venture capital. "The financial markets are a fascinating puzzle," I often say, "and I love helping people make sense of them." That's what drives me to bring clear and insightful financial journalism to the readers of Coincu.
News

Ledger Connect Kit Exploit Still Under Active Investigation

Key Points:
  • Ledger faced a brief security breach on December 14th through its Connect Kit, affecting third-party DApps.
  • The wallet issuer swiftly addressed the Ledger Connect Kit exploit, freezing stolen funds, filing a complaint, and deactivating malicious code within two hours.
  • It plans to enhance security measures, connecting its build pipeline to NPM for continuous improvement in cybersecurity.
In a public letter, Pascal Gauthier, Chairman and CEO of Ledger, addressed a recent security breach involving the Ledger Connect Kit exploit, a Javascript library linking websites to wallets.

Ledger Connect Kit Exploit Still Under Active Investigation

Ledger’s Swift Response to Ledger Connect Kit Exploit

On December 14, hackers exploited the kit, prompting Ledger to swiftly eliminate the vulnerability with its partners. The breach was limited to third-party dApps using the Ledger Connect Kit and is currently under investigation.

Ledger, known for stringent security practices, emphasized that the incident was an isolated case. The company, which filed a complaint, has frozen stolen funds and pledged assistance to affected users in recovering their assets. Ledger is actively cooperating with law enforcement to track and apprehend the perpetrators.

Ledger Takes Proactive Measures After Recent Security Incident

To enhance security measures, Ledger plans to implement stricter controls in its build pipeline, connecting it to the NPM distribution channel. The company emphasized the dynamic nature of security and the need for continuous improvement.

The letter revealed that the Ledger Connect Kit exploit resulted from a former employee falling victim to a phishing attack, allowing the malicious code to run for less than two hours. Ledger promptly released Connect Kit version 1.1.8, deactivating the malicious code in Ledger and WalletConnect. While users are now safe, Ledger recommends waiting 24 hours and clearing the browser cache as a precautionary measure.

DISCLAIMER: The information on this website is provided as general market commentary and does not constitute investment advice. We encourage you to do your own research before investing.