Ledger, a crypto wallet company, recently suffered a security breach on December 14. The intrusion into Ledger’s Connect Kit library led to the theft of $484,000 from various wallets in the Ledger cyberattack. The funds were allegedly siphoned off in less than two hours.
However, the malicious code has now been successfully neutralized.
According to Ledger’s statement, a former employee was allegedly the victim of a phishing scam, allowing the pirate to access the Ledger Connectkit library and submit a malicious bug.
Regarding the Ledger hack, the company confirmed the security incident in an official statement, providing a comprehensive overview of the situation and outlining steps taken to mitigate the exposure.
“The real Ledger Connect Kit 1.1.8 is now fully released. Ledger and WalletConnect can confirm that the malicious code has been disabled. You can now use your Ledger Connect kit safely. Remember that we always encourage a clear signature,” the latest update reads.
Ledger Cyberattack: What Happened?
According to the official statement, the hack allowed the attacker to release a hacked Ledger Connect kit version 1.1.5 to 1.1.7, which tricked Walletconnect into sending money to the hacker’s wallet.
Although the malicious file remained active for approximately five hours, Ledger’s technical and security teams quickly implemented a solution within 40 minutes of discovering the Ledger file. cyber attackthe company revealed.
The company’s latest update confirmed that the genuine Ledger Connect Kit 1.1.8 has been widely distributed and validated.
The official statement further states that in order to avoid direct package changes, development teams using the Ledger Connect Kit on NPM have been limited to read-only access.
Ledger reported that Chainalysis software was now able to view the wallet and had frozen the rogue actor’s address after Ledger. cyber attack.
The Ledger revealed the wallet address: “0x658729879fca881d9526480b82ae00efc54b5c2d“, responsible for the incident, but they have not verified the figures. At the time the account was closed, $254,000 was in the wallet.
In addition to actively interacting with affected customers, the hardware wallet maker is assisting law enforcement in their efforts to apprehend the attacker following the Ledger attack. cyber attack.
Ledger also revealed that it is looking into the exploit in order to stop similar attacks in the future. Ledger once again emphasized the value of a clear signature and recommended a blind signature with manual transaction processing or an additional Ledger Mint wallet.
Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only and users take full responsibility for their reliance on it. THE Cyber Express assumes no responsibility for the accuracy or consequences of the use of this information.