Ledger Connect Kit Hack

On December 14, 2023, an attacker published malicious versions of the Ledger Connect Kit, a JavaScript library that many EVM dApps load at runtime to connect to Ledger devices. Ledger said a former employee was phished and the attacker used that person's npm access, which had not been revoked at offboarding, to publish versions 1.1.5, 1.1.6 and 1.1.7. The injected code contained the Angel Drainer kit and made dApp users sign transactions that drained their wallets.

Lookonchain estimated about $484,000 was stolen, and Blockaid's CEO put impacted funds at hundreds of thousands of dollars within the first two hours. Ledger did not publish a figure. Ledger deployed a genuine version (1.1.8) about 40 minutes after it learned of the attack, but CDN caching kept the malicious file available for about five hours in total; Ledger estimated active draining lasted under two hours. WalletConnect disabled the rogue project used to route funds, and Tether froze the attacker's USDT. Ledger said the attacker never had access to its infrastructure, its code repositories or the dApps themselves.