Understanding the Recent Hack on Ledger Connect Kit

In a startling turn of events, the Web3 community was shaken by a significant security breach. Users of popular dApps like SushiSwap, Zapper.fi, and RevokeCash reported suspicious activities, signaling a potential compromise in a widely-used Web3 connector. This breach serves as a stark reminder of the ever-present vulnerabilities in the DeFi space.

Inside the Attack

The heart of the issue lay in the Ledger Connect Kit library (Ledger Connect Kit v1.1.7). Ledger, a prominent player in digital asset security, confirmed that this library was indeed compromised. 

The attackers injected malicious code into the library, transforming it into a ‘drainer’ that targeted users’ wallets. It was possible as a result of a phishing attack targeting the former employee’s npmJS account. This code affected every website utilizing the library, instigating widespread panic among users.

The drainer operated by siphoning funds from wallets, but only after users inadvertently granted approvals to the malicious smart contract. Thus, merely visiting an infected site did not pose an immediate threat. However, once approvals were given, the funds were swiftly drained to two primary wallets: 

0x412f10aad96fd78da6736387e2c84931ac20313f and 0x658729879fca881d9526480b82ae00efc54b5c2d, with over $850,000 being stolen in just a few hours.

❗️@SushiSwap, @zapper_fi and @RevokeCash front-ends are compromised!

Stay safe and do not interact with this platform!

🧵All updates will be posted below…

— Hacken🇺🇦 (@hackenclub) December 14, 2023

Lessons Learned

Rigorous Code Auditing: Regular and thorough audits of third-party libraries are essential.

Check Access: Regularly check and revoke access, especially for former employees.

User Awareness: Users must understand the approvals they grant on dApps.

Rapid Response: The need for quick action in the face of security breaches cannot be overstated.

Diversified Asset Allocation: Avoid storing significant funds in a single asset or platform.

Clear Communication: Ensuring timely and transparent communication with users during crises is crucial.

Conclusion

The swift action by Ledger to rectify the issue and Tether’s freezing of the attacker’s wallet highlight the resilience of the Web3 community. However, this incident reminds us how important it is to always be alert and to keep learning about digital assets. As we go forward, we should all work together to strengthen our security, stay up-to-date, and carefully make our way through the ever-changing world of Web3 with a better understanding of how to stay safe.

Follow @hackenclub on 𝕏 (Twitter)