The front end of multiple decentralized applications (DApps) using Ledger’s connector, including Zapper, Sushiswap, and Revoke.cash, was compromised on Dec. 14.
SushiSwap chief technical officer Mathew Lilley reported that a commonly used Web3 connector has been compromised, allowing malicious code to be injected into numerous DApps. The on-chain analyst said the Ledger library confirmed the compromise where the vulnerable code inserted the drainer account address.
RED ALERT :
— I'm Software (@MatthewLilley) December 14, 2023
Do not interact with ANY dApps until further notice. It appears that a commonly used web3 connector has been compromised which allows for injection of malicious code affecting numerous dApps.
SushiSwap CTO blamed Ledger for the ongoing vulnerability and compromise on multiple DApps. The CTO claimed that Ledger’s content delivery system (CDN) was compromised followed by a a chain of terrible blunders - where they first loaded java script from a compromised CDN while not version-locking loaded JS.
Ledger connector is a library used by many DApps and maintained by Ledger. A wallet drainer has been added, so the draining from a user’s account might not happen on its own. However, prompts from a browser wallet (like MM) will display and could give malicious actors access to the assets.
On-chain analysts warned users to avoid any DApps using the Ledger connector, adding that the connect-kit-loader is also vulnerable.
seems like the Ledger's @ledgerhq/connect-kit npm package was hacked, the latest publish was 2 hours ago. https://t.co/jFb6CThljS pic.twitter.com/AsbA675D9Q
— Scam Sniffer | Web3 Anti-Scam (@realScamSniffer) December 14, 2023
This is a developing story, and further information will be added as it becomes available.
