The dependency was the attack surface
Ledger Connect Kit is a library dapps use to talk to Ledger devices. Many loaded it from a CDN at runtime rather than pinning a version and bundling it. That meant a single malicious publish propagated automatically into live production front ends, with no action by the dapp teams and no deployment on their side.
The injected code was a wallet drainer: it presented users with a transaction that transferred their assets. Crucially, this affected users who did not own a Ledger device at all. The library was in the page; the hardware was irrelevant.
What hardware wallets do and do not protect
It would be wrong to read this as a hardware wallet failure, and equally wrong to read it as vindication. A hardware wallet protects the key. It does not decide whether a transaction is a good idea — it shows you the transaction and asks. If the request reaching the device is malicious and you approve it, the device performs exactly as designed.
The defence that would have worked is reading what the device displayed before approving. That is a genuinely difficult ask: transaction data is often opaque, and users are trained by hundreds of routine approvals to click through. But it is the control that existed, and the reason the loss was measured in hundreds of thousands rather than considerably more is that some users did read it.
The class, not the incident
Runtime-loaded dependencies in a page that can request signatures are a standing risk. The relevant hardening is on the dapp side — pinning versions, subresource integrity, bundling rather than CDN-loading — and it is invisible to users, which is why this class keeps recurring.
Timeline
Append-only. Corrections are added as their own dated entry; earlier entries are never rewritten.
What to check
Ledger published a statement, linked below, with the timeline and the affected versions. Ledger devices and the Ledger Live application were not themselves compromised.
Conisec does not host or link recovery, revocation or "checker" tools. After a public incident, attackers routinely seed exactly those links using the names of publications covering the story. Use the affected project's own official channel, linked above, and nothing else.
Sources
- Ledger, Ledger Connect Kit exploit — official statement (14 Dec 2023)
Not advice. This is a summary of published facts, not legal, tax or security advice. Verify against the primary sources linked above.
Last verified by Conisec Staff.
