Ledger pledges full compensation for victims of $600k ConnectKit exploit

cyptouser7 months agoCryptocurrencies News136

Hardware wallet provider Ledger has announced it will fully reimburse users impacted by the vulnerability that compromised its ConnectKit library last week.

Additionally, the firm promised to disable blind signing—a process where users approve transactions without verifying their content—on its devices for Ethereum virtual machine (EVM)-compatible decentralized applications (dApps) by June 2024.

$600k stolen

In a Dec. 20 statement on X (formerly Twitter), the firm revealed that its ConnectKit library compromise resulted in the theft of approximately $600,000 in digital assets from users who blind-signed on EVM dApps.

Ledger affirmed its commitment to compensating the affected individuals by February 2024 and disclosed its active engagement with these users.

On Dec. 14, CryptoSlate reported that Ledger’s ConnectKit library was hacked by attackers who replaced a genuine version with a malicious file that redirects funds to a wallet controlled by the hacker.

The breach impacted several prominent DeFi projects, including SushiSwap, which immediately advised their users not to interact with the frontend of their websites.

Bolstering security

While Ledger immediately pushed an update to rectify the situation, the firm has further pledged to continue its focus on bolstering security measures to safeguard the ecosystem and prevent future occurrences.

As part of this commitment, Ledger intends to collaborate with the dApp ecosystem to implement Clear Signing—a process allowing users to verify all transaction details before approving them—and phase out the Blind Signing feature from its devices by June 2024.

“Our commitment is to work with the community and DApp ecosystem to allow Clear Signing so users can verify all transactions on Ledger devices before signing. This will lead to a new standard to protect users and encourage Clear Signing across DApps,” Ledger wrote.

According to the firm, Clear Signing will empower users to verify all transactions on their devices before signing, serving as an effective measure to mitigate front-end attacks on cryptocurrency platforms.

It added:

“Front-end attacks have happened many times before and will continue to plague our ecosystem. The only foolproof countermeasure for this type of attack is to always verify what you consent to on your device. This is only possible with Clear Signing: meaning you can see and verify exactly what you sign on a secure display.”

The content on this website comes from the Internet. Due to the inconvenience of proofreading the authenticity and accuracy of the copyright or content of some content, it may be temporarily impossible to confirm the authenticity and accuracy of the copyright or content. For copyright issues or other issues caused by this, please Call or email this site. It will be deleted or changed immediately after verification.

related articles

Bankruptcy law firm S&C absolved from misconduct, according to new FTX proposal

Bankruptcy law firm S&C absolved from misconduct, according to new FTX proposal

55966e89˃While FTX’s new amended proposal promised “billions in compensation,” creditors are unhappy...

Bitcoin’s daily transactions reach new record high

Bitcoin’s daily transactions reach new record high

1205f261˃Bitcoin transactions reached a new all-time high of 926,842 transactions, just three days a...

FTX secretly used Deltec Bank to create and sell Tether for profit, lawsuit alleges

FTX companies created and profited from Tether through an arrangement with a partner bank, according...

VanEck intends to be first spot ETH ETF issuer, argues against simultaneous approvals

VanEck Head of Digital Assets Research Matthew Sigel said on May 22 that the firm should be able to...

Acting OCC chief says tokenization holds immense promise, but crypto still risky

The acting chief of the U.S. Office of the Comptroller of the Currency (OCC), Michael Hsu, said he i...

Worldcoin ordered to stop operations in Hong Kong

55966e89˃Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD) has concluded its i...