Ledger Warns Users Not to Connect to DApps After Malicious Version Identified

According to Decrypt, hardware wallet manufacturer Ledger has warned users not to connect to decentralized applications (dapps) after a malicious version of the Ledger Connect Kit was identified. A spokesperson for Ledger stated that a genuine version is being pushed to replace the malicious file and that users should not interact with any dapps for the moment. The spokesperson also confirmed that Ledger devices and the Ledger Live app were not compromised. Software wallet developer MetaMask has also warned users to stop using dapps as news of the attack broke. Web3 security firm BlockAid reported that the attacker injected a wallet draining payload into the ledgerconnect kit's NPM package, affecting dapps using versions 1.1.4 and above of Ledger's connect-kit, including Sushi.com and Hey.xyz. SushiSwap CTO Matthew Lilley criticized Ledger for a chain of blunders and advised users to avoid using any dapps until their teams confirm that they have mitigated the attack.