In the web3 landscape, several security breaches occurred in the last month, impacting not only investor sentiment but also the ongoing market rally. Amidst discussions with the Security and Exchange Commission (SEC) regarding the approval of the Bitcoin Exchange Traded Fund (ETF), the front end of several decentralized applications (DApps), including prominent platforms like Zapper, SushiSwap, Balancer, and Revoke.cash, fell victim to a security breach.
DApps Zapper, SushiSwap, Balancer, and Revoke compromise
SushiSwap’s Chief Technical Officer, Mathew Lilley, disclosed that a widely-used Web3 connector had been compromised, enabling the injection of malicious code into multiple DApps. Looking at this, the Ledger library confirmed the compromise, disclosing that the vulnerable code inserted the address of a “drainer” account.
Behind the security breach incident, SushiSwap’s SUSHI token hasn’t been significantly affected. Currently, it is trading near $1.17, and in the last 24 hours, it has only experienced a 0.70% downward movement.
However, Lilley placed responsibility directly on Ledger for the ongoing vulnerability and compromise across multiple DApps. He also argued that Ledger’s content delivery system (CDN) had been compromised, mentioning a series of critical errors. These included loading JavaScript from a compromised CDN without version-locking the loaded JS.
The Ledger connector, a fundamental library for numerous DApps maintained by Ledger, became the focal point of the attack. A wallet drainer was introduced, potentially granting unauthorized access to user assets. While autonomous draining from a user’s account may not occur, prompts from a browser wallet, such as MetaMask, could expose assets to malicious actors.
Avoid Ledger Connector DApps: On-chain analysts
On-chain analysts issued a strict warning, advising users to steer clear of any DApps using the Ledger connector. They highlighted the vulnerability of the connect-kit-loader, highlighting that any DApp utilizing LedgerHQ/connect-kit is at risk. This incident is not an isolated attack but rather a large-scale assault on multiple DApps.
Hudson Jameson, Vice President of Polygon Labs, highlighted the need for caution even after Ledger rectified the compromised code. Projects using and deploying the library must update before it is safe to use DApps relying on Ledger’s Web3 libraries.
Acknowledging the vulnerability, Ledger announced the removal of the malicious version of the Ledger Connect Kit. Simultaneously, efforts are underway to push a genuine version to replace the compromised file. The crypto community remains on high alert, closely monitoring updates to ensure the security of assets in the aftermath of this widespread attack.
