Ledger Connect Kit Hack

Ledger Connect Kit is a piece of code made by Ledger that many crypto websites used to let visitors connect their Ledger hardware wallets. On 14 December 2023, an attacker phished a former Ledger employee whose access to the account used to publish this code had never been removed. The attacker used that access to publish a malicious version of Connect Kit. Because websites loaded the latest version automatically, the malicious code spread to many popular crypto websites, including SushiSwap and Revoke.cash, and showed visitors fake requests that handed their funds to the attacker.

Funds were actively drained between roughly 10:30 and 13:20 UTC, and around $610k was stolen on Ethereum, BNB Chain, Polygon, Arbitrum, Optimism, Avalanche and Base. Ledger released a clean version about 40 minutes after it was alerted, WalletConnect disabled a rogue setup the attacker was using to drain funds, and Tether froze about $27k of the stolen USDT. Many websites, like SushiSwap and Revoke.cash, quickly went offline and removed the library, but some took longer. Ledger committed to reimbursing affected users and worked with law enforcement to track down the attacker.

The attack did not affect Ledger hardware wallets or the Ledger Live app, only websites that used the library. If you used any crypto website between roughly 10:30 and 13:20 UTC on 14 December 2023, check whether you approved any of the listed addresses and revoke those approvals. Affected users could contact Ledger support about reimbursement. Note that some of the listed addresses are generic drainer infrastructure that was also used for other phishing campaigns, so a match does not necessarily mean that you were affected by this particular hack.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.