In a recent and alarming development, the Decentralized Finance (DeFi) space faced a rug-pull security breach with a supply chain attack on the Ledger ConnectKit.<\/span><\/p>\n The vulnerability, now labeled a \u201csupply chain attack,\u201d poses a serious risk to users and their assets, potentially allowing malicious code injection into various Decentralized Applications (dApps). The compromised package identified in the attack is LedgerHQ\u2019s ConnectKit, specifically versions greater than 1.1.4, according to Web3 security firm, Blockaid.<\/span><\/p>\n <\/p>\n The impact of the supply chain attack on Ledger ConnectKit was felt across various DeFi protocols. Blockaid mentioned that SushiSwap, Kyber, RevokeCash, and Zapper were among the vulnerable decentralized exchanges<\/a><\/span>.\u00a0<\/span><\/p>\n Reacting promptly to the threat, Kyber and RevokeCash disabled their front ends. It is worth noting that this vulnerability comes only shortly after KyberSwap fell victim to a major exploit<\/a> that<\/span>\u00a0resulted in the loss of around $46 million in various cryptocurrencies.\u00a0<\/span><\/p>\n <\/p>\n Blockaid estimates that approximately $150,000 has been lost within just a few hours, emphasizing the immediate and widespread impact of the attack. The security firm was quick to assure users of Blockaid-enabled wallets that they are protected from this specific threat, but the broader implications of this attack could pose substantial risks to the broader Web3 ecosystem.<\/span><\/p>\n <\/p>\n The origin of the vulnerability traces back to the use of a specific Content Delivery Network (CDN) to host the Ledger ConnectKit software library. Matthew Lilly, the Chief Technology Officer of Sushi, explained,\u00a0<\/span><\/p>\n \u201cLedgerHQ\/connect-kit loads JS from a CDN, their CDN account has been compromised which is injecting malicious JS into multiple dApps.\u201d<\/span><\/p>\n<\/blockquote>\n In response to the attack, Ledger issued a statement acknowledging the compromise and assuring users that a genuine version of the Ledger ConnectKit is being pushed to replace the malicious file. A software patch has also been developed <\/a><\/span>to address the vulnerability.<\/span><\/p>\n As a precautionary measure, users are strongly advised to refrain from interacting with any dApps associated with the Ledger ConnectKit until further notice. The incident highlights the importance of continuous security audits, proactive measures, and swift responses to emerging threats to safeguard the integrity of decentralized financial systems.\u00a0<\/span><\/p>\n <\/p>\n \u2713 Share:<\/p>\nThe Ledger ConnectKit Attack Unveiled<\/strong><\/h2>\n
\n
Ledger Unveils Response and Recovery Efforts<\/strong><\/h2>\n
![\"coingape\"](\"https:\/\/cdn.coingape.com\/wp-content\/uploads\/2023\/08\/14164721\/x-logo.png\"){kind=logo}
![\"\"](\"https:\/\/secure.gravatar.com\/avatar\/733ca3c15c1fbb2629eeb51edb886efb?s=200&d=mm&r=g\"\/)
![\"\"](\"https:\/\/secure.gravatar.com\/avatar\/733ca3c15c1fbb2629eeb51edb886efb?s=200&d=mm&r=g\")