Ledger ex-staff phished in library compromise

2023-12-14 21:10:49

The hard wallet maker said a former employee fell victim to a phishing scam, which allowed a hacker to access the library and steal $480,000 in crypto.

Ledger’s chairman and CEO, Pascal Gauthier, attested to an exploit on Ledger Connect Kit, a Java library to connect Web sites to wallets on several defi platforms. Gauthier’s letter said the incident was isolated to third-party applications and stressed that Ledger’s hard wallet products remained unaffected.

The standard practice at Ledger is that no single person can deploy code without review by multiple parties. We have strong access controls, internal reviews, and multi-signature code when it comes to most parts of our development. This is the case in 99% of our internal s. Any employee who leaves the company has their access revoked from every Ledger .

Pascal Gauthier, chairman and CEO, Ledger

However, Gauthier confirmed that an ex-staff was hacked by a phishing scammer who then used compromised account access to publish a rogue WalletConnect project. This allowed bad actors to reroute user funds

The Dec. 14 exploit affected several defi apps like SushiSwap and Revoke.cash, crypto.news reported.

Ledger’s update on the issue verified observations made by crypto participants on social media. One user identified a GitHub account linked to an ex-Ledger developer, Junichi Sugiura. Gauthier’s post did not identify the former employee, and Sugiura had not replied to requests for comments

Tether froze an address linked to the hacker, according to CTO Paolo Ardoino. Meanwhile, CertiK reported ERC-20 transactions made by wallets likely affiliated with the exploiter.

The exploit marked the second time in two months that phishers have leveraged Ledger to steal user funds. In November, crypto investigator ZachXBT warned users of a fake Ledger Live app on the official Microsoft app store. The fraudulent app siphoned Bitcoin (BTC) and Ether (ETH) worth $768,000.

Trang này có thể chứa nội dung của bên thứ ba, được cung cấp chỉ nhằm mục đích thông tin (không phải là tuyên bố/bảo đảm) và không được coi là sự chứng thực cho quan điểm của Gate hoặc là lời khuyên về tài chính hoặc chuyên môn. Xem Tuyên bố từ chối trách nhiệm để biết chi tiết.