The Ledger Connect Kit Attack Explained

Video transcript

Ledger's hardware was never touched. One phished npm account shipped a wallet drainer to dApps through Connect Kit.

In December 2023, a former Ledger employee was phished, and the attacker took over their npm account. Three malicious versions followed, carrying Angel Drainer to upwards of 100 frontends, Blockaid says.

Ledger revoked internal access, but not npm. The attacker bypassed two factor authentication with a session token, and one account could publish alone. dApps loaded the kit from a CDN at runtime, so none had to update.

The first bad version went live at nine forty nine, Central European Time. Blockaid flagged it before Ledger knew. Funds were actively drained for less than two hours, Ledger says.

Ledger put the loss at about six hundred thousand dollars, stolen from users blind signing on EVM dApps. It pledged to make affected users whole.

Pinning versions could not help, because the code was fetched at runtime. The check is release control: offboarding every registry, a second approver, and build provenance for publishing.

Guardian's SDK Audit reviews both the source and the published package, because the gap between them is where supply chain risk lives. It covers release control, the published artifact and transaction construction.

Read the full article for the timeline and lessons, or explore Guardian's SDK Audit to check who can ship your SDK.

Ledger's hardware was never touched. The attack ran through Connect Kit, a JavaScript library that dApps use to connect to Ledger devices.

On December 14, 2023, dApps that loaded it served a wallet drainer to their users for hours. It went after any wallet that connected, not only Ledger's, BleepingComputer reported.

The weak point was who could publish, not the code under review.

What Happened

Most dApps loaded Connect Kit through a loader package, Ledger says.

On the morning of December 14, a former Ledger employee fell for a phishing attack. The attacker gained access to that person's npm account.

Over the next few hours, the attacker published three malicious versions to npm: 1.1.5, 1.1.6 and 1.1.7.

The code carried Angel Drainer, which Ledger calls "a malware as a service" built to craft malicious transactions. It used a rogue WalletConnect project to reroute assets to the attacker.

Blockaid, which flagged the attack early, says it hit upwards of 100 frontends. It named hey.xyz, sushi.com and zapper.xyz among them.

How the Attack Worked

The publish rights

Ledger had revoked the former employee's access to its own systems. But its report says "the former employees' access to NPMJS was not properly revoked."

The account had 2FA. Ledger's report says the attacker bypassed it with the person's session token, and elsewhere cites an API key tied to the account.

The report adds that npm "does not allow multi-authorization or signature verification for automatic publishing." One account was enough to ship a release.

The loader

The Connect-Kit-loader lets a dApp load Connect Kit "at runtime from a CDN," Ledger says. Its npm readme says this lets Ledger ship changes without dApps releasing new builds.

That design helped the attack spread. dApps did not need to update or redeploy anything to serve the malicious version.

It also slowed the cleanup. Ledger says the malicious file "remained accessible for a little longer" while CDN caches refreshed.

The drain

Per Ledger, the drainer tricked users into signing:

• Approvals and permits for ERC-20 tokens and NFTs.
• Fake "claim" transactions or transfers for native tokens.

Onchain, stolen funds were split 85% to the exploiter and 15% to Angel Drainer, Ledger and Blockaid report.

Timeline and Loss

From the npm compromise to full resolution took about five hours, Ledger says. It estimates funds were actively drained for "less than two hours in total."

The loss

• Ledger: "approximately $600,000 in assets impacted, stolen from users blind signing on EVM DApps," in a post cited by The Block.
• Third parties: around $500,000, per The Block.
• BleepingComputer: $600,000 on the day, noting reports of about $680,000 and that final losses were not yet known.

WalletConnect disabled the rogue project, and Tether froze the attacker's USDT after Ledger coordinated with both.

Ledger pledged to make affected users whole, its customers or not, by the end of February 2024, The Block reported. It also pledged to stop allowing blind signing on its devices by June 2024.

What It Shows

The devices were not the weak point. The release path was.

1. Offboarding must reach every registry. Ledger revoked internal access but not npm.
2. 2FA does not stop a stolen session. Ledger says the attacker worked from the session token.
3. One credential should not ship a release. Require a second approver and build provenance for publishing.
4. Runtime loading multiplies one bad release. Every integrator served it without a rebuild.
5. Lockfiles cannot help here. Pinning protects builds, not code fetched from a CDN at runtime.
6. Blind signing was the opening. Ledger said the stolen funds came from users blind signing.

Outside detection also mattered. Blockaid flagged the attack before Ledger knew of it.

For the dApp side, see our guide to dApp frontend supply chain security and our explainer on blind signing. Another compromised package: the @solana/web3.js backdoor.

How an SDK Audit Tests This

Guardian's SDK Audit page uses this incident as its example:

"The wallet was never broken. Three malicious versions of the library it publishes reached every dApp that had installed it."

The audit reviews both the source and the published package. In the page's words, "the gap between them is where supply-chain risk lives."

Two of its areas map to this attack:

• Release control: who can publish, whether 2FA and provenance are enforced, and how a bad version gets pulled.
• Published artifact: what ships to the registry versus the repo, including install scripts and dependencies.

It also covers transaction construction: what the SDK hands the wallet, and whether it matches the requested call.

The audit covers TypeScript, Python, Rust, Go and JVM client libraries for EVM and Solana. It is scoped by the public surface and the release pipeline.

Frequently Asked Questions

Were Ledger hardware wallets hacked in the Connect Kit attack?

No. Ledger says the exploit "did not and does not affect the integrity of Ledger hardware or Ledger Live." The malicious code ran in dApps that loaded Connect Kit, and it targeted any wallet that connected.

Which Ledger Connect Kit versions were malicious?

Versions 1.1.5, 1.1.6 and 1.1.7, all published to npm on December 14, 2023. Ledger published the genuine version 1.1.8 that afternoon.

How much was stolen in the Ledger Connect Kit hack?

Ledger said it was aware of about $600,000 in assets impacted. The Block cited third-party estimates of around $500,000. Ledger pledged to make affected users whole by the end of February 2024.

Would pinning the package version have helped?

Not for dApps using the loader. It fetched Connect Kit from a CDN at runtime, so a new release reached users without any rebuild.

Sources

• Ledger: A letter from Ledger Chairman & CEO Pascal Gauthier regarding Ledger Connect Kit exploit (December 14, 2023)
• Ledger: Security Incident Report (December 20, 2023)
• Blockaid: Attack Report, Ledger Connect Kit (December 14, 2023)
• BleepingComputer: Ledger dApp supply chain attack steals $600K from crypto wallets (December 14, 2023)
• The Block: Ledger to change transaction signing process after exploit, promises to return funds (December 20, 2023)
• npm registry: @ledgerhq/connect-kit publish times (read November 2026)
• npm: @ledgerhq/connect-kit-loader readme (read November 2026)
• Guardian: SDK Security Audit