SECURITY

Ledger has updated its version, vulnerability caused by former employee falling for phishing, Tether freezes hacker address

share
Ledger has updated its version, vulnerability caused by former employee falling for phishing, Tether freezes hacker address

The Ledger hardware wallet recently experienced a large-scale security vulnerability, leading to multiple third-party DApps being attacked. Hackers managed to steal approximately $484,000, but the funds were frozen by Tether. Ledger has urgently released an updated version to patch the vulnerability and is cooperating with law enforcement to recover the funds.

Ledger hit by major security breach, numerous DApps affected, SlowMist: Do not operate, wait patiently for updates from all parties

Ledger Emergency Update

Ledger has released an update to Ledger Connect Kit version 1.1.8 in the early morning and confirmed that the malicious code has been deactivated.

Although users can now safely use it, Ledger still recommends waiting for 24 hours and deleting browser cache.

Tether CEO: Hacker Address Frozen

The total amount affected has not yet been confirmed, but blockchain tracking entity Lookonchain has indicated that a hacker stole $484,000.

The address was promptly frozen by Tether.

Ledger CEO also mentioned that they have been in contact with law enforcement and will assist affected users in recovering their funds.

Ledger CEO Incident Report

CEO Pascal Gauthier elaborated on this incident in a lengthy post, summarized as follows:

  1. The crypto industry collaborated with Ledger to address the Ledger Connect Kit vulnerability, which was active for less than two hours.

  2. This vulnerability was caused by a former Ledger employee falling victim to a phishing attack.

  3. Ledger promptly froze the funds, collaborated with law enforcement, and assisted affected users in fund recovery.

  4. This vulnerability does not and will not affect Ledger hardware devices or Ledger Live, past or present.

  5. This vulnerability is limited to third-party DApps using the Ledger Connect Kit.