{"id":213013,"date":"2023-12-15T04:54:57","date_gmt":"2023-12-14T23:24:57","guid":{"rendered":"https:\/\/dripp.zone\/news\/ledger-ceo-on-hacking-incident-the-threat-has-passed-crypto-news\/"},"modified":"2023-12-15T04:55:00","modified_gmt":"2023-12-14T23:25:00","slug":"ledger-ceo-on-hacking-incident-the-threat-has-passed-crypto-news","status":"publish","type":"post","link":"https:\/\/dripp.zone\/news\/ledger-ceo-on-hacking-incident-the-threat-has-passed-crypto-news\/","title":{"rendered":"Ledger CEO on Hacking Incident, “The Threat Has Passed” – Crypto News"},"content":{"rendered":"

<\/p>\n

\n

In light of the recent Ledger Hacking, the Decentralized Finance (DeFi) protocol\u2019s Chairman and CEO, Pascal Gauthier has issued a new update<\/a><\/span>.<\/span><\/p>\n

Ledger Hacking Acknowledged and Explained<\/strong><\/h2>\n

He started by acknowledging the recent exploit<\/a> w<\/span>hich involved the injection of malicious code into the Javascript library. It affected mostly versions greater than 1.1.4, that is, versions 1.1.5, 1.1.6, and 1.1.7.\u00a0 Furthermore, he explained that the hack was as a result of a loophole exploited by the bad actor.\u00a0<\/span><\/p>\n

<\/p>\n

A former employee fell victim to a phishing attack that eventually provided a bad actor with access to upload a malicious file to Ledger\u2019s NPMJS. This NPMJS is a package manager for Javascript code shared between apps. Ledger swung into action immediately to salvage the situation with support from WalletConnect, its partner. At once, the NPMJS was removed and the malicious file was immediately disabled.<\/span><\/p>\n

All these happened within forty minutes of the exploit\u2019s discovery. Gauthier highlighted the alliance as a good reference of the industry working swiftly together to tackle security challenges that plagues the ecosystem.\u00a0<\/span><\/p>\n

Hacker Exploit Scare is Over<\/strong><\/h2>\n

<\/p>\n

Ordinarily, no single person has the sole power to deploy codes on Ledger\u2019s ConnectKit as he would require that some other parties review the transaction. At the same time, Gauthier clarified that every employee who leaves the company at any time and for whatever reasons, always has their access to the Ledger systems revoked at once.\u00a0<\/span><\/p>\n

<\/p>\n

Prior to exiting the company, employees are granted access to controls, internal reviews, and multi-signature code especially, as it has to do with most parts of Ledger\u2019s development.\u00a0This is prevalent in 90% of the firm\u2019s development. Gauthier suggested that the DeFi protocol had previously imbibed security strategies to protect investors.\u00a0<\/span><\/p>\n

However, the latest attack is a clear proof and reminder that security is not static. Therefore, \u201cLedger must continuously improve our security systems and processes. In this area, Ledger will implement stronger security controls, connecting our build pipeline that implements strict software supply chain security to the NPM distribution channel.\u201d<\/span><\/p>\n

A new version of the Ledger Connect Kit has been introduced<\/a><\/span> and users who intend to keep utilizing the tool, are advised to upgrade to this version. Once Ledger Connect Kit version 1.1.8 is installed, users may have to wait for up to 24 hours before activating. So far, it\u2019s looking good plus Gauthier has assured users that the situation is now under control and \u201cthe threat has passed.\u201d<\/span><\/p>\n

<\/p>\n

\n
\n

\u2713 Share:<\/p>\n

<\/a><\/p>\n

\n
\n