Cyberattack on Ledger's Connector Library Leads to Theft of $484,000 in Ether
Summary:
Following a cyberattack on Ledger's connector library, a hacker managed to steal no less than 4.334 Ether, equivalent to around $484,000. Several platforms and protocols like MetaMask, Zapper and SushiSwap were affected. While MetaMask has issued a fix for its platform, Ledger has replaced the malicious file and urged its users to "Clear Sign" transactions, and several protocols have deactivated the compromised library. This story is still developing.
A cyberattack on Ledger's connector library led to the theft of at least 4.334 Ether (ETH), equivalent to approximately $484,000, as reported by blockchain analysis tool Lookonchain. Ledger has yet to verify the amount, but the financial implications of the security incident could potentially rise to hundreds of thousands, says the firm.
Social media platform X users, previously known as Twitter, raised the alarm concerning the event on December 14, indicating a widely used Web3 connector suffered a breach. This vulnerability allowed a hostile party to introduce harmful code into numerous decentralized applications (DApps). The precarious aftermath impacts protocols like Zapper, SushiSwap, Phantom, Balancer, and Revoke.cash with the potential for even wider ramifications. Some X platform users argue that similar, substitute programs to LedgerHQ/connect-kit may share this loophole.
MetaMask, another victim of this hack, has announced that their users will also be affected. However, the wallet provider swiftly implemented a repair on their platform, reassuring its users of the latest variant v2.121.0. Users were assured that they should regain normal transactional functioning and updates would apply automatically. Users operating older versions were urged to refresh their site's data.
The hacker event led to Ledger conveying, roughly three hours post-incident, that the hostile version of the file was swapped with the authentic edition approximately at 1:35 pm UTC. The tech enterprise cautioned its users to "Clear Sign" transactions consistently, emphasizing that only the details and addresses on the Ledger screen are legitimate. Users were alerted to immediately suspend any transaction if discrepancies between the Ledger device and computer/phone screen are observed.
Post-incident, Ledger's library was deactivated by several protocols. Paolo Ardoino stated that stablecoin issuer Tether also immobilised the fraudulent address.
Additional findings will be reported on this evolving story.
Published At
12/14/2023 6:33:35 PM
Disclaimer: Algoine does not endorse any content or product on this page. Readers should conduct their own research before taking any actions related to the asset, company, or any information in this article and assume full responsibility for their decisions. This article should not be considered as investment advice. Our news is prepared with AI support.
Do you suspect this content may be misleading, incomplete, or inappropriate in any way, requiring modification or removal?
We appreciate your report.