Ledger Acts to Boost Security: Plans to End Blind Signing on Ethereum dApps

Ledger's Response to Recent $600k Exploit

In a significant move following a costly exploit, Ledger has declared its intention to cease blind signing for Ethereum dApps. This decision, announced today, comes in the wake of an incident that resulted in over $600k in losses.

Blind Signing: A Risky Affair

Blind signing involves a user authorizing a transaction without complete understanding of its contents. The details, typically in raw smart contract signing data, are not easily interpretable by users.

Ledger's Proactive Measures

By June 2024, Ledger aims to eliminate blind signing in Ethereum dApps supported by its hardware wallets. The company is also committed to compensating the victims of the recent hack. Additionally, Ledger is collaborating with its community and ecosystem partners to promote Clear Signing as a security standard.

The Importance of Clear Signing

Clear signing contrasts sharply with blind signing. It allows users to view transaction details in a human-readable format, ensuring they understand what they approve. This approach fosters transparency and aids in verifying the legitimacy of transactions.

The Incident's Origin

Our coverage highlighted the exploit's origins in a phishing attack targeting a former Ledger employee. The attacker employed an "Angel Drainer attack," leading to unauthorized asset transfers from unsuspecting dApp users.

Ledger's Security History

In 2020, Ledger faced a data breach in its e-commerce database, revealing personal data of over 270,000 customers. However, Ledger has refuted any link between this breach and its wallet security.

Despite Ledger's efforts to reinforce security, the vulnerability of digital assets to sophisticated cyber-attacks remains an unresolved challenge in the blockchain space.