* . *
  • About
  • Advertise
  • Privacy & Policy
  • Contact
Wednesday, October 15, 2025
Earth-News
  • Home
  • Business
  • Entertainment
    Bluesman James Montgomery Will Perform In Falmouth – CapeNews.net

    Blues Legend James Montgomery Ready to Ignite the Stage in Falmouth

    Mexican singer Pedro Fernández to make Ave Fénix tour stop in Stockton. Tickets, schedule – Yahoo

    Mexican Singer Pedro Fernández Brings the Ave Fénix Tour to Stockton – Don’t Miss It!

    Flutter Entertainment’s SWOT Analysis: Uncovering the Growth Potential Amid Challenges

    Dylan Efron Shares Sweet ‘DWTS’ Rehearsal Photos Featuring His Little Sister Olivia – yahoo.com

    Dylan Efron’s Heartwarming ‘DWTS’ Rehearsal Moments with Little Sister Olivia

    Diane Keaton, Oscar-Winning Star of ‘Annie Hall’ and ‘The Godfather,’ Dies at 79 – Yahoo

    Diane Keaton, Oscar-Winning Star of ‘Annie Hall’ and ‘The Godfather,’ Dies at 79 – Yahoo

    THE VAMPIRE LESTAT Shares First Look Teaser Trailer (And It’s Fangtastic) – Yahoo

    THE VAMPIRE LESTAT Shares First Look Teaser Trailer (And It’s Fangtastic) – Yahoo

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    Tracking DNA and RNA Together To Unlock Disease Insights – Technology Networks

    Unlocking Disease Insights by Tracking DNA and RNA Together

    The future of battery technology – Engineer Live

    Revolutionizing Energy: Exploring the Future of Battery Technology

    How Can Boosting Your Travel Experience with Less Technology Lead to a More Relaxing Vacation? All You Need to Know About This Latest Trend – Travel And Tour World

    How Can Boosting Your Travel Experience with Less Technology Lead to a More Relaxing Vacation? All You Need to Know About This Latest Trend – Travel And Tour World

    Davenport CornCon Cybersecurity Conference helps students explore technology, AI use – KWQC

    Davenport CornCon Cybersecurity Conference Ignites Student Passion for Technology and AI Innovations

    Inside Europe’s military technology resurgence – NBC News

    Europe’s Bold Comeback: Unveiling the Rise of Cutting-Edge Military Technology

    Vicor Corporation: Great Technology, Execution Trapped In Time (NASDAQ:VICR) – Seeking Alpha

    Vicor Corporation: Innovative Technology Hindered by Lackluster Execution

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
  • Home
  • Business
  • Entertainment
    Bluesman James Montgomery Will Perform In Falmouth – CapeNews.net

    Blues Legend James Montgomery Ready to Ignite the Stage in Falmouth

    Mexican singer Pedro Fernández to make Ave Fénix tour stop in Stockton. Tickets, schedule – Yahoo

    Mexican Singer Pedro Fernández Brings the Ave Fénix Tour to Stockton – Don’t Miss It!

    Flutter Entertainment’s SWOT Analysis: Uncovering the Growth Potential Amid Challenges

    Dylan Efron Shares Sweet ‘DWTS’ Rehearsal Photos Featuring His Little Sister Olivia – yahoo.com

    Dylan Efron’s Heartwarming ‘DWTS’ Rehearsal Moments with Little Sister Olivia

    Diane Keaton, Oscar-Winning Star of ‘Annie Hall’ and ‘The Godfather,’ Dies at 79 – Yahoo

    Diane Keaton, Oscar-Winning Star of ‘Annie Hall’ and ‘The Godfather,’ Dies at 79 – Yahoo

    THE VAMPIRE LESTAT Shares First Look Teaser Trailer (And It’s Fangtastic) – Yahoo

    THE VAMPIRE LESTAT Shares First Look Teaser Trailer (And It’s Fangtastic) – Yahoo

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    Tracking DNA and RNA Together To Unlock Disease Insights – Technology Networks

    Unlocking Disease Insights by Tracking DNA and RNA Together

    The future of battery technology – Engineer Live

    Revolutionizing Energy: Exploring the Future of Battery Technology

    How Can Boosting Your Travel Experience with Less Technology Lead to a More Relaxing Vacation? All You Need to Know About This Latest Trend – Travel And Tour World

    How Can Boosting Your Travel Experience with Less Technology Lead to a More Relaxing Vacation? All You Need to Know About This Latest Trend – Travel And Tour World

    Davenport CornCon Cybersecurity Conference helps students explore technology, AI use – KWQC

    Davenport CornCon Cybersecurity Conference Ignites Student Passion for Technology and AI Innovations

    Inside Europe’s military technology resurgence – NBC News

    Europe’s Bold Comeback: Unveiling the Rise of Cutting-Edge Military Technology

    Vicor Corporation: Great Technology, Execution Trapped In Time (NASDAQ:VICR) – Seeking Alpha

    Vicor Corporation: Innovative Technology Hindered by Lackluster Execution

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
Earth-News
No Result
View All Result
Home Technology

Hundreds of thousands of dollars in crypto stolen after Ledger code poisoned

December 16, 2023
in Technology
Hundreds of thousands of dollars in crypto stolen after Ledger code poisoned
Share on FacebookShare on Twitter

Cryptocurrency wallet maker Ledger says someone slipped malicious code into one of its JavaScript libraries to steal more than half a million dollars from victims.

The library in question is Connect Kit, which allows DApps – decentralized software applications – to connect to and use people’s Ledger hardware wallets.

Pascal Gauthier, CEO of Ledger, in a public post said a former employee had been duped by a phishing attack, which allowed an unauthorized party to upload a malicious file to the company’s NPM registry account.

“The attacker published a malicious version of the Ledger Connect Kit (affecting versions 1.1.5, 1.1.6, and 1.1.7),” said Gauthier. “The malicious code used a rogue WalletConnect project to reroute funds to a hacker wallet.”

The malicious file was what’s known as a “crypto drainer” – it siphons funds from digital wallets. And because dozens of crypto projects utilize the Connect Kit library, the potential financial loss could have been considerable. The damage however was limited because the compromised file was only live for about five hours and active for about two.

During this period, it’s claimed that the attacker managed to obtain more than $610,000 worth of crypto tokens. Revoke.cash, a service for revoking certain crypto transactions – which was affected by the incident – reports losses on the order of $850,000.

According to Gauthier, the attack was addressed within 40 minutes of discovery, the attacker’s blockchain address has been identified, and Tether has frozen the attacker’s Tether tokens. Authorities, he claims, have been notified.

“The authentic and verified version of the Ledger Connect Kit, version 1.1.8, is now in circulation and safe to use,” said Gauthier.

“Safe” may be overstating the case: According to security firm Socket, which provides algorithmic assessments of NPM packages, Connect Kit currently rates 51 out of 100 for Supply Chain Security and 55 out of 100 for Quality.

Money-grubbing crooks abuse OAuth – and baffling absence of MFA – to do financial crimes

Interpol moves against human traffickers who enslave people to scam you online

Crypto crasher Do Kwon’s extradition approved, but destination is unclear

48-nation bloc to crack down on using crypto assets to avoid tax

Gauthier insists standard practice at Ledger is that no one person can deploy code without a multiparty review.

“We have strong access controls, internal reviews, and multi-signature code when it comes to most parts of our development,” he said. “This is the case in 99 percent of our internal systems. Any employee who leaves the company has their access revoked from every Ledger system.”

And yet Ledger’s account of the incident – a former employee surrendered credentials to a phishing scheme, allowing a miscreant to gain access to Ledger’s NPM account to push through bad code – suggests this was one occasion where company security controls fell short.

According to Rosco Kalis, a software engineer for Revoke.cash, Ledger did not have two-factor authentication in place for NPM, which presumably would have prevented the phishing attack from working. What’s more, Kalis claimed Ledger failed to revoke code publication rights for its former employee.

Gauthier characterized this fiasco as an “unfortunate isolated incident” and said, “Ledger will implement stronger security controls, connecting our build pipeline that implements strict software supply chain security to the NPM distribution channel.”

The Ledger leader’s reference to the NPM distribution channel glosses over the way in which Connect Kit actually gets distributed.

Kalis pointed out that Ledger distributes Connect Kit through a content delivery network (CDN), which means that developers cannot pin the library – limit it to a specific version. Instead, applications that depend on the library always fetch the latest release, which becomes problematic when the latest release has been hijacked.

“Generally speaking, developers protect against supply chain attacks by ‘pinning’ the versions of dependencies that they install,” Kalis said.

Kalis accepted some of the blame by acknowledging that while Ledger should not have published its library in a way that did not support dependency pinning, Revoke.cash should have realized Connect Kit’s distribution method posed a security risk.

However, Kalis isn’t ready to shoulder the burden of compensating those who have lost funds.

“Due to the widespread nature of the exploit, it is impossible to determine which of the victims of the exploit got compromised on Revoke.cash and which got compromised on other websites,” he wrote. “This is why we unfortunately do not see it as a feasible solution for Revoke.cash or other affected websites to directly compensate impacted users.”

Kalis says the only answer as he sees it is for victims to seek reimbursement for losses from Ledger, adding, “It is currently unclear if Ledger plans to do this.”

Ledger, based in France, did not immediately respond to a request for comment. ®

>>> Read full article>>>
Copyright for syndicated content belongs to the linked Source : The Register – https://go.theregister.com/feed/www.theregister.com/2023/12/16/ledger_crypto_conect_kit/

Tags: Hundredstechnologythousands
Previous Post

Ubiquiti blunder let some folks view others’ security cameras, accounts

Next Post

Mayim Bialik Won’t Be Reading Any More (Syndicated) Jeopardy! Clues

Preview: could Premier League fitness make the difference in recurve men? – World Archery

Could Premier League Fitness Be the Game-Changer for Recurve Men?

October 15, 2025
The $2.5 trillion ocean economy is at a crossroads. Capital must act now – Fortune

The $2.5 Trillion Ocean Economy at a Crossroads: Why Urgent Capital Investment Is Essential

October 15, 2025
Bluesman James Montgomery Will Perform In Falmouth – CapeNews.net

Blues Legend James Montgomery Ready to Ignite the Stage in Falmouth

October 15, 2025
30-year decline in Kansas health can be reversed with leadership, report finds – Kansas Reflector

30-year decline in Kansas health can be reversed with leadership, report finds – Kansas Reflector

October 15, 2025
Scorecard ranks Northwest politician as the most Trump-aligned Democrat in Congress – OregonLive.com

Northwest Politician Touted as the Most Trump-Aligned Democrat in Congress

October 14, 2025
CVYS reiterates ban on activities threatening ecology and public order – Nagaland Tribune

CVYS Takes a Strong Stand to Protect Ecology and Public Safety

October 14, 2025
Inaugural Implementation Science Symposium Highlights Excitement for Burgeoning Discipline – Geisel School of Medicine at Dartmouth

Inaugural Implementation Science Symposium Ignites Excitement for Emerging Field

October 14, 2025
Scientists find the brain’s hidden pulse that may predict Alzheimer’s – ScienceDaily

Scientists find the brain’s hidden pulse that may predict Alzheimer’s – ScienceDaily

October 14, 2025
You know you’re smarter than someone if these 10 thought patterns are obvious to you but not them – VegOut

10 Thought Patterns That Show You’re Smarter Than Most People

October 14, 2025
New Strider Report Reveals Scope and Scale of U.S. Academic Research Done in Collaboration with PLA-Affiliated Entities on STEM Technologies – PR Newswire

New Strider Report Reveals Widespread U.S. Academic Collaborations with PLA-Linked Entities in STEM Technologies

October 14, 2025

Categories

Archives

October 2025
M T W T F S S
 12345
6789101112
13141516171819
20212223242526
2728293031  
« Sep    
Earth-News.info

The Earth News is an independent English-language daily published Website from all around the World News

Browse by Category

  • Business (20,132)
  • Ecology (867)
  • Economy (889)
  • Entertainment (21,761)
  • General (17,598)
  • Health (9,931)
  • Lifestyle (901)
  • News (22,149)
  • People (889)
  • Politics (899)
  • Science (16,099)
  • Sports (21,388)
  • Technology (15,868)
  • World (872)

Recent News

Preview: could Premier League fitness make the difference in recurve men? – World Archery

Could Premier League Fitness Be the Game-Changer for Recurve Men?

October 15, 2025
The $2.5 trillion ocean economy is at a crossroads. Capital must act now – Fortune

The $2.5 Trillion Ocean Economy at a Crossroads: Why Urgent Capital Investment Is Essential

October 15, 2025
  • About
  • Advertise
  • Privacy & Policy
  • Contact

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

Go to mobile version