Hackers attacked DApps using Ledger Connect tool code vulnerability

The company assured that they have already eliminated the malware version of the tool

14.12.2023 - 14:16

187

3 min

What’s new? Hardware wallet maker Ledger said it has removed a malicious version of the Ledger Connect kit, a tool that allows developers to connect their decentralized applications to the company’s physical devices. Earlier, an anonymous blockchain analyst under the nickname banteg reported that the tool’s library had been compromised and replaced with malicious code to empty users’ wallets, prompting him to recommend against interacting with apps using Ledger Connect. He later confirmed that the company had updated the code and fixed the vulnerability.

Source: Twitter.com

What else is known? Due to the incident, decentralized exchanges (DEXs) SushiSwap and KyberSwap have temporarily disabled their user interfaces to avoid losing funds. At the time of writing, KyberSwap has restored the interface, assuring that it was not affected by the Ledger Connect exploit. At the same time, the exchange’s team urged users to be cautious when connecting their wallets to decentralized applications, attaching a screenshot of the malicious interface.

Source: Twitter.com

For its part, SushiSwap is still working on removing the Ledger Connect tool. The developers warned that the wallet connection window that pops up when visiting the exchange’s website is malicious. Experts at blockchain audit firm PeckShield said the exchange’s interface has been compromised.

Source: Twitter.com