Crypto Flexs
  • DIRECTORY
  • CRYPTO
    • ETHEREUM
    • BITCOIN
    • ALTCOIN
  • BLOCKCHAIN
  • EXCHANGE
  • TRADING
  • HACKING
  • SLOT
  • CASINO
  • SUBMIT
Crypto Flexs
  • DIRECTORY
  • CRYPTO
    • ETHEREUM
    • BITCOIN
    • ALTCOIN
  • BLOCKCHAIN
  • EXCHANGE
  • TRADING
  • HACKING
  • SLOT
  • CASINO
  • SUBMIT
Crypto Flexs
Home»EXCHANGE NEWS»Security Warning: Avoid using dApps due to Ledger Connectkit hack
EXCHANGE NEWS

Security Warning: Avoid using dApps due to Ledger Connectkit hack

By Crypto FlexsDecember 14, 20234 Mins Read
Facebook Twitter Pinterest LinkedIn Tumblr Email
Security Warning: Avoid using dApps due to Ledger Connectkit hack
Share
Facebook Twitter LinkedIn Pinterest Email

Malicious code injected into Ledger’s ConnectKit library compromised a number of decentralized finance (DeFi) applications this morning. This vulnerability allowed a wallet exfiltration exploit that links a user’s wallet when they visit an affected dapp, providing access to steal funds.


key point

  • Malicious code was injected into Ledger’s ConnectKit library, allowing a “wallet drainer” to steal funds from user accounts when connecting to a decentralized app (dapp).
  • The attack affected several dapps, including SushiSwap, Zapper, Balancer, and Revoke.cash. Users were prompted to link their wallets, which gave them access to the outflow.
  • Ledger acknowledged the issue and removed the malware, but said projects using the affected libraries should update to remain secure.
  • The vulnerability may still result in funds being depleted, so users should avoid interacting with any dapps that use Ledger’s connector kit until further notice.
  • The total amount of funds leaked so far is estimated to be in the hundreds of thousands of dollars, but the full impact is still being assessed.

The issue was first reported publicly by the developer on Twitter, warning users to avoid interacting with the dapp. Ledger soon confirmed that its ConnectKit library had been compromised and was pushing an update to replace the malware. However, Ledger warned users not to use any dapps in the meantime.

A number of popular DeFi platforms were affected, including major decentralized exchange SushiSwap. After becoming aware of the attack, SushiSwap took its front end offline, warning users that there was a serious issue with their Ledger connector. Other affected dapps include Zapper, Balancer, and Revoke.cash.

????????????? Red warning ????????????:

Please do not interact with any dApps until further notice. It appears that a commonly used web3 connector may have been compromised, allowing malicious code to be injected affecting a large number of dApps.

— I’m a software ??????? (@MatthewLilley) December 14, 2023

The malware exploited Ledger’s connector kit, which connects hardware wallets to decentralized apps to enable transaction signing. The code inserted a wallet address associated with the attacker, allowing funds to be drained from the user’s account when the browser wallet MetaMask approved the message.

Although the Ledger hardware wallet and the Ledger Live app itself were not compromised, malicious JavaScript injected into the ConnectKit library left Web3 users vulnerable when approving transactions on the dapp.

At least $150,000 has already been stolen, according to cybersecurity firm BlockAid, which first identified the wallet drainer payload. However, numerous dapps were compromised before Ledger removed the malware, so the full damage is still being assessed.

???? We have detected a potential supply chain attack against the Ledgerconnect kit ???
Attackers injected a wallet-draining payload into a popular NPM package.
This currently affects several popular dapps, including but not limited to https://t.co/2QJmKIGv9T.

— Block Aid (@blockaid_) December 14, 2023

Ledger accepted responsibility for the vulnerability, with the company’s CTO citing a “horrible series of mistakes” that could have compromised its content delivery network. This enabled JavaScript attacks when users interacted with dapps that relied on Ledger ConnectKit.

????We have identified and removed a malicious version of the Ledger Connect Kit. ????

A genuine version is currently being promoted to replace the malicious file. Do not interact with any dApps at this time. We will keep you posted as the situation develops.

With your Ledger device…

— Ledger (@Ledger) December 14, 2023

Even after Ledger patches the exploit, DeFi platforms using the affected libraries will need to update their wallet integrations before they can safely reconnect. With users warned to avoid decentralized apps for the time being, developers are scrambling to apply fixes to avoid further theft.

The cyberattack highlights the risks associated with connecting hardware wallets to DeFi platforms and serves as a reminder to exercise caution before approving a transaction. If users refrain from interacting with the dapp, their funds are likely not at risk, but the potential implications are still unfolding.

Hundreds of thousands have already been confirmed stolen. However, the full toll of this coordinated cyberattack on Web3 infrastructure is still unknown as many sites assess whether they unknowingly integrated compromised Ledger libraries, putting user funds at risk.

Share. Facebook Twitter Pinterest LinkedIn Tumblr Email

Related Posts

Cardano (ADA) Signal Recovery -Is there a strong rise?

September 15, 2025

The price of Etherrium surges beyond $ 4,500. -Main level for monitoring more profits

September 12, 2025

Bitcoin Price Struggle $ 113K -Will Bulls take a break?

September 9, 2025
Add A Comment

Comments are closed.

Recent Posts

Green Hood Contracts Thanksgiving Summary -Ackee Blockchain

September 17, 2025

BetFury Is At SBC Summit Lisbon 2025: Affiliate Growth In Focus

September 17, 2025

FED Mining’s Cloud Mining Platform Is Helping Users Earn $8,800 Per Day, And XRP’s Growth Is Driving Market Enthusiasm.

September 17, 2025

Stablecoin Holdings Drop As Investors Pivot To SOL, XRP, And Altcoins

September 17, 2025

Flipster Partners With WLFI To Advance Global Stablecoin Adoption Through USD1 Integration

September 17, 2025

Zircuit Launches $495K Grants Program To Accelerate Web3 Super Apps

September 16, 2025

Kintsu Launches SHYPE On Hyperliquid

September 16, 2025

New Cryptocurrency Mutuum Finance (MUTM) Raises $15.8M As Phase 6 Reaches 40%

September 16, 2025

How XRP Enthusiasts Can Earn $15k/Day

September 16, 2025

Bringing 1R0R To R0AR Chain Unlocks New Incentives

September 16, 2025

As the Air drop recipient is sold, the infinite price is 46% conflict after Binance listing.

September 16, 2025

Crypto Flexs is a Professional Cryptocurrency News Platform. Here we will provide you only interesting content, which you will like very much. We’re dedicated to providing you the best of Cryptocurrency. We hope you enjoy our Cryptocurrency News as much as we enjoy offering them to you.

Contact Us : Partner(@)Cryptoflexs.com

Top Insights

Green Hood Contracts Thanksgiving Summary -Ackee Blockchain

September 17, 2025

BetFury Is At SBC Summit Lisbon 2025: Affiliate Growth In Focus

September 17, 2025

FED Mining’s Cloud Mining Platform Is Helping Users Earn $8,800 Per Day, And XRP’s Growth Is Driving Market Enthusiasm.

September 17, 2025
Most Popular

According to the Brad Garlinghouse CEO, as the SEC ends a lawsuit for Ripple, XRP Rallies

March 19, 2025

Just In: Grayscale File for Bitcoin (BTC) Covered Call ETF

January 11, 2024

MEXC offers stories (IP) Launchpool & AirDrop+, 68,500 IP and 50,000 USDT bonuses.

February 13, 2025
  • Home
  • About Us
  • Contact Us
  • Disclaimer
  • Privacy Policy
  • Terms and Conditions
© 2025 Crypto Flexs

Type above and press Enter to search. Press Esc to cancel.