Crypto Gloss

Ledger Hack / Connect Kit Attack

The Ledger Connect Kit attack was a December 2023 software supply-chain incident in which an attacker published malicious versions of a JavaScript library used by third-party decentralized applications (dApps). It did not compromise Ledger hardware or its Ledger Live application. Instead, malicious code in affected dApp interfaces could deceive people using different wallets into signing transactions that transferred assets.

What Ledger Connect Kit does

Connect Kit is a library that helps a website connect a user’s wallet to an application. Some dApps used a loader that fetched the library at runtime from a package distribution network. That made the page dependent on the code delivered by the package publisher: a malicious update could reach the dApp’s visitors without the dApp first shipping a new version of its own site.

How the incident unfolded

Ledger’s incident report says a former employee was phished and an attacker used access to that employee’s NPMJS account to publish malicious Connect Kit versions 1.1.5, 1.1.6, and 1.1.7 on December 14, 2023. Ledger said the former employee’s access to some external tools had not been revoked during offboarding. The malicious code used a rogue WalletConnect project and crafted transactions intended to drain assets from people interacting with affected dApps.

The affected component was a web library, not the private-key storage chip in a hardware wallet. A malicious prompt still depended on a user signing a transaction. This distinction does not make the incident harmless: people may be deceived by a familiar interface, and a hardware signer cannot make an unsafe transaction safe merely because the user confirms it.

Scope, response, and reported losses

Ledger said the malicious code appeared in dApps that loaded Connect Kit dynamically. It reported no access to Ledger’s own infrastructure, code repository, or the dApps themselves, and said Ledger hardware and Ledger Live were not affected. Blockaid’s analysis described the impact across more than 100 front ends using the vulnerable package. Ledger estimated the period of active asset draining at under two hours, although cached malicious files remained available longer while content-delivery networks updated.

Ledger said its teams deployed a genuine fix within 40 minutes of being alerted, and the broader cleanup took longer as caches propagated. Independent security analysis put the theft at roughly US$600,000; this is an estimate from incident analysis rather than a ledger of final victim losses or recoveries. Affected dApps, wallets, and infrastructure providers coordinated to block the malicious project and trace or freeze some assets.

Security lessons

  • Runtime dependencies are part of a dApp’s attack surface: loading code from a package or content-delivery service can expose users when that dependency is compromised.
  • Offboarding must cover external services: removing an employee from company systems does not automatically revoke every external publishing account or token.
  • Review the transaction itself: users should understand the destination, asset, and permission being approved; a wallet connection is not proof that a request is legitimate.
  • Scope matters: this incident affected dApp front ends loading the compromised library. It was not evidence that all Ledger users or hardware wallets were compromised.

Social Media Sentiment

An archived December 2023 thread in r/ledgerwallet shows users urgently asking whether hardware wallets, Ledger Live, and other dApps were affected. Commenters expressed concern about the library’s reach and the offboarding failure; some recommendations were posted before the incident was fully understood. This is a snapshot of the initial response, not a measure of current Ledger security or community opinion.

Last updated: 2026-10

Related Terms

See Also

Sources