IMPORTANT: Ledger ConnectKit Library has been Compromised with a drainer.

[BitMaxz]

Anyone knows whether Electrum uses the library as well?

This is about Ledger and their connector library, i do not know too much about Dapps and how some of them use ledger's connector library, but this has nothing to do with Electrum, even if you have your Electrum connected to your Ledger wallet, just make sure you're running your own node for better privacy and security. Ledger isn't a recommended hardware wallet, so people should not even be using this hardware wallet in the first place.

Yes, Electrum shouldn't be affected by this vulnerability because Electrum doesn't use a ledger connect kit.

@btc_penguin If you don't feel safe there is a way to make a transaction on Electrum safe you just need two devices to make an unsign transaction from the online device and transfer the .psbt file to the offline device to sign it with your ledger offline. All ledger users should do this if they want to avoid any online attacks/vulnerabilities.

[1714677564]

1714677564

[1714677564]

1714677564

[1714677564]

1714677564

[NotATether]

Anyone knows whether Electrum uses the library as well?

No it does not, because it does not even support dApps.

[pawanjain]

Just when I thought of buying a hardware wallet this happened and now I am reconsidering it.
Ledger is facing such attacks quite frequently now. It's not good for a company like Ledger to have such security flaws.
I wonder why is only Ledger facing such attacks. Are other hardware wallet companies like Trezor very good at their side ?

[Zaguru12]

Just when I thought of buying a hardware wallet this happened and now I am reconsidering it.
Ledger is facing such attacks quite frequently now. It's not good for a company like Ledger to have such security flaws.
I wonder why is only Ledger facing such attacks. Are other hardware wallet companies like Trezor very good at their side ?

Since they started that there seed phrase storage saga, I think they have been compromised atleast two times, although this doesn’t affect anything much except those that interact with DApps but still this continuous breach can be seen as negligence and as the popular saying goes fool me once, shame on you. Fool me twice, shame on me. So I will advise you a little change of hardware wallets, Trezor hardly get into news like the way ledger devices does, but there are also other good hardware wallets like passport.

Better still if you have two devices, one which is still airgapped then I will say you should consider setting up a cold wallet with wallets like electrum.

[Z-tight]

Just when I thought of buying a hardware wallet this happened and now I am reconsidering it.
Ledger is facing such attacks quite frequently now. It's not good for a company like Ledger to have such security flaws.
I wonder why is only Ledger facing such attacks. Are other hardware wallet companies like Trezor very good at their side ?

This should not affect or influence your decision of buying a hardware wallet, i hope you were not considering purchasing a Ledger hardware wallet, because it is not recommended, and even if they didn't have a problem with their connector library, they are still not recommended because of past issues, like ledger recover for example.

Look for recommended hardware wallets, passport is a good one, or set up your own airgapped wallet if you have the knowledge to do it.

[PrivacyG]

This sucks.  Newbies purchase Shit Coins and they end up getting scammed in the most innocent way.  They sign a Contract they can not understand anyway and they end up having their Wallets cleared.  Then they buy a Ledger and guess what.  Ledger is not as secure as it seems.

Altcoins nowadays seem like a one click disaster.  You sign the wrong Contract which is unreadable in the first place and poof goes your money.

I am waiting for the day some body finds a backdoor to read Seeds out of Ledgers.  At this point this is inevitable and would be nothing new for Ledgers customers.

[digaran]

It seems those developers are incompetent, that's why you should stay away from garbage such as dapp, you can't just go and develop something like this which involves money after being grounded by your parents, unfortunately they do that and people follow and use their apps blindly.

[o48o]

Would you like a little dose of conspiracy theory?

After this compromise, Ledger will definitely release new firmware for their devices (they can’t help but do this), into which you can integrate any program code directed against the interests of ledger owners (like even more tracking and obtaining personal data or even gaining complete control over their means).

Horror story (they could have pulled this off a long time ago).

But seriously, what can I say. Ledger screwed up again. Happens. I mean, it has happened more than once. We weren't surprised at all. I wonder what the next fakap will be?

I honestly wonder why wouldn't they be liable for losses. They are a private company making money, and only reason they exist is because people trust their product safety.
I am sure that there are some disclaimers for something like this in their small print but i don't think that would legally cover for losses that happens because of exploit of their product.

Sure, everyone is responsible for their own money in crypto, but i think this goes to gray area on liability. I guess we have to wait and see. Anyway, this was bad news.

[tabas]

Just when I thought of buying a hardware wallet this happened and now I am reconsidering it.
Ledger is facing such attacks quite frequently now. It's not good for a company like Ledger to have such security flaws.
I wonder why is only Ledger facing such attacks.

It's because they have the vast market share and that's why they're targeted but, this isn't the first time that we've seen them in the news. Aside from this compromise, they've got a feature of recover that many don't like it and shoudn't really be considered. Too many attacks and controversy has happened with Ledger and that sucks.

Are other hardware wallet companies like Trezor very good at their side ?

I'm thinking of taking a Blockstream hardware wallet named Jade but I am still gathering reviews about it.

[rat03gopoh]

Though the news only states we should not be connecting to dApps, what happens if I just connect it normally synch with the network?

It shouldn't matter, the KonncetKit Library is the door to this vulnerability. You only connect to this library if you interact with Dapps, not when start connecting to the internet or just syncing your balance.

[takuma sato]

This is why you should forget about getting any bitcoins-specific hardware at all and just stick to good ol laptops, ideally laptops that can run free as in freedom firmware, that will not have any running spyware chips or unnecessary blobs there. This is where you will have the most peace of mind when doing bitcoin, anything else is compromised and if not, then just a target to be. If you have something specific to store bitcoins that is a bigger target than some laptop with linux for obvious reasons.

[rat03gopoh]

This is why you should forget about getting any bitcoins-specific hardware at all and just stick to good ol laptops, ideally laptops that can run free as in freedom firmware, that will not have any running spyware chips or unnecessary blobs there. This is where you will have the most peace of mind when doing bitcoin, anything else is compromised and if not, then just a target to be. If you have something specific to store bitcoins that is a bigger target than some laptop with linux for obvious reasons.

Hardware Wallets are actually quite safe if they remain in use in their orientation, long-term holding, that's all. As an advantage, they're more practical than carrying a laptop. Unfortunately, many users request that wallets also function for strange things because the crypto ecosystem continues to develop. In essence, everything depends on the user's caution, regardless of the type of wallet.

[pawanjain]

Just when I thought of buying a hardware wallet this happened and now I am reconsidering it.
Ledger is facing such attacks quite frequently now. It's not good for a company like Ledger to have such security flaws.
I wonder why is only Ledger facing such attacks. Are other hardware wallet companies like Trezor very good at their side ?

This should not affect or influence your decision of buying a hardware wallet, i hope you were not considering purchasing a Ledger hardware wallet, because it is not recommended, and even if they didn't have a problem with their connector library, they are still not recommended because of past issues, like ledger recover for example.

Look for recommended hardware wallets, passport is a good one, or set up your own airgapped wallet if you have the knowledge to do it.

That's true. I mean, I wasn't gonna buy Ledger at first place but when you're thinking of buying a hardware wallet and see a major hardware wallet company getting hacked then it becomes harder for you to choose a hardware wallet because you might want to reconsider your decision.
I do know how to configure an airgapped PC. That's a good option but hardware wallets are more convenient to use with their ease of access.

[nelson4lov]

This is why you should forget about getting any bitcoins-specific hardware at all and just stick to good ol laptops, ideally laptops that can run free as in freedom firmware, that will not have any running spyware chips or unnecessary blobs there. This is where you will have the most peace of mind when doing bitcoin, anything else is compromised and if not, then just a target to be. If you have something specific to store bitcoins that is a bigger target than some laptop with linux for obvious reasons.

If anyone wants to go down this path, the laptop has to be offline (zero connection to the internet) most of the time otherwise, it's still likely to be exposed to even popular vulnerabilities. I still think hardware wallets have a place compared to mobile wallets that are very prune to a wide variety of attacks.

Why Ledger's hardware wallet came under scrutiny throughout the duration of the vulnerability was because many of their users connected to dapps directly using their ledger wallet and also because they could allow a past employee to still pose risks to their products in turn, affecting users.

[libert19]

Why Ledger's hardware wallet came under scrutiny throughout the duration of the vulnerability was because many of their users connected to dapps directly using their ledger wallet and also because they could allow a past employee to still pose risks to their products in turn, affecting users.

Connecting ledger with dapps was mistake indeed, if people stop using their hardware wallets as hot wallets, they wouldn't fall victim to such exploits. Use hw like cold storage, send funds to other wallet to interact with dapps and you will be fine.

Couple weeks ago, I was wondering if I should stake crypto through ledger live, I got my answer with this hack.

[Pmalek]

If anyone wants to go down this path, the laptop has to be offline (zero connection to the internet) most of the time otherwise, it's still likely to be exposed to even popular vulnerabilities.

Not most of the time. All of the time. After you install a fresh OS onto it (Linux is recommended), it should never be connected to the internet ever again. Removing the network/WIFI cards ensures that you can't even mistakenly connect it to the internet.

I am reading the response of Ledger's CEO and can't help but to giggle. The guy is talking about the standard security practices the company uses and goes on to say how multiple parties review code before it's deployed. They control who can access what internally, and if an employee leaves the company, they revoke all access rights. Sadly, everyone was asleep when it comes to the alleged ex employee who was able to upload the code changes without anyone else reviewing it and still had the needed access rights despite being an ex-employee.

https://www.ledger.com/blog/a-letter-from-ledger-chairman-ceo-pascal-gauthier-regarding-ledger-connect-kit-exploit

[sokani]

This is people's hard earned money for christ sake and I'm shocked at the level of negligence from the ledger team. The message came from their official GitHub page and there was no case of hack reported, meaning an authorized personnel who had access to the account deployed the malicious code. if it's not from a team member, who could possibly have done this? A former employee who still have the login details? Ledger truly sucks at security and I'm surprised people still trust them with their funds.

[Lakai01]

[...]
Sadly, everyone was asleep when it comes to the alleged ex employee who was able to upload the code changes without anyone else reviewing it and still had the needed access rights despite being an ex-employee.

That is indeed an absolute madness and I wouldn't even expect something like that from a start-up. In my opinion, it also shows how badly the ledger's internal processes must be set up for a former employee's account to retain access to central repositories.

Ledger truly sucks at security and I'm surprised people still trust them with their funds.

I'd be off Ledger in a heartbeat if there was finally a viable alternative for people who have a larger stack of altcoins. At least my altcoins, e.g. AVAX, still can't be staked via Trezor - or any other competing product. To be honest, I don't understand why the competition doesn't utilize the penalties that have been set up ...

[Pmalek]

The message came from their official GitHub page and there was no case of hack reported, meaning an authorized personnel who had access to the account deployed the malicious code. if it's not from a team member, who could possibly have done this? A former employee who still have the login details?

Yes, that's exactly what they stated publicly. But it doesn't matter if it's an ex-employee or a current employee. It looks bad either way. If it's an ex-employee, why would he still have access rights and the ability to manually change code without anyone else's permission and verification? If it's a current employee, why does he not have the skills to recognize a scam and phishing attempt when he is working in a position with such security clearances?! 

I'd be off Ledger in a heartbeat if there was finally a viable alternative for people who have a larger stack of altcoins. At least my altcoins, e.g. AVAX, still can't be staked via Trezor - or any other competing product.

Trezor supports AVAX via third-party wallets, such as MetaMask, MyCrypto, and Rabby. Have you checked if any of those solutions have a staking feature for AVAX?

To be honest, I don't understand why the competition doesn't utilize the penalties that have been set up.

What do you mean? What penalties?

[Lakai01]

I'd be off Ledger in a heartbeat if there was finally a viable alternative for people who have a larger stack of altcoins. At least my altcoins, e.g. AVAX, still can't be staked via Trezor - or any other competing product.

Trezor supports AVAX via third-party wallets, such as MetaMask, MyCrypto, and Rabby. Have you checked if any of those solutions have a staking feature for AVAX?

Yes, I have looked at some alternatives. The problem with all other manufactors is that they only support the AVAX C-Chain via the respective hardware wallet, including Metamask. Staking via Avalanche requires the P-Chain, which is currently only fully supported by Ledger.

What do you mean? What penalties?

My bad, looks like that's a German saying, sorry for that
This means that the competition makes serious mistakes (like a penalty kick in soccer), but you are not able to take advantage of the mistakes. Specifically, Trezor, for example, has announced that it will focus its development activities entirely on the Trezor Suite and will not work on (broader) support for other blockchains. However, if Trezor were to fully support the top 25 coins here (including staking, for example), more people would definitely switch from Ledger to Trezor - myself included.