The Ledger Connect Kit Hack: What Happened and What Crypto Users Can Learn

By LazurusGroup | Cybersecurity & Web3 Security

The cryptocurrency industry has repeatedly learned an uncomfortable lesson: securing a hardware wallet is only part of the security equation.

One of the most significant examples came in December 2023, when attackers compromised the software supply chain surrounding Ledger Connect Kit, a JavaScript library used by decentralized applications (DApps) to connect with Ledger hardware wallets.

The incident did not involve an attacker directly breaking the cryptographic security of Ledger hardware wallets. Instead, attackers compromised a former Ledger employee's access to an external package-management account and used that access to distribute malicious code. (Ledger)

What Happened?

On December 14, 2023, a former Ledger employee became the victim of a sophisticated phishing attack. According to Ledger's investigation, the attacker obtained access to the employee's NPMJS account through a session token/API credential, despite two-factor authentication being enabled.

The attacker subsequently published malicious versions of Ledger Connect Kit, specifically versions 1.1.5, 1.1.6 and 1.1.7. (Ledger)

The compromised library could then be loaded by DApps that incorporated Ledger's Connect Kit loader.

This transformed what might ordinarily have been a single-account compromise into a software supply-chain attack capable of affecting users interacting with multiple applications.

How the Attack Worked

The malicious code incorporated a wallet-draining mechanism that Ledger identified as Angel Drainer.

Instead of stealing users' private keys directly, the malicious software attempted to manipulate what users were signing.

Depending on the targeted asset, the malicious code could present users with requests involving token approvals, permits, or transactions that ultimately enabled assets to be transferred to attacker-controlled addresses.

This distinction is important.

A hardware wallet can protect a private key extremely well while a user is still vulnerable to signing a malicious transaction.

In other words:

Protecting the key is not enough if the user is tricked into authorizing the wrong transaction.

Ledger's investigation found that the attacker never obtained access to Ledger's hardware-wallet infrastructure, source-code repository, or the DApps themselves. The compromise occurred through the distribution mechanism for the Connect Kit library. (Ledger)

A Supply-Chain Problem

The incident demonstrates why modern cybersecurity cannot focus exclusively on an organization's own servers.

Modern applications depend on enormous chains of third-party software, package registries, cloud services, APIs and developer accounts.

An attacker doesn't necessarily need to compromise the final application.

Sometimes, compromising a trusted dependency is enough.

In this case, the malicious package was distributed through NPMJS and dynamically loaded by applications that already relied on Ledger Connect Kit. Ledger reported that the malicious package remained accessible for approximately five hours, while the period in which assets were actively being drained was estimated to have been less than two hours. (Ledger)

Why the Incident Was So Important

The Ledger incident changed the conversation around hardware-wallet security.

Hardware wallets are designed to keep private keys isolated from potentially compromised computers and applications. But cryptocurrency transactions ultimately require authorization.

If a user sees a transaction request and approves something they do not fully understand, the security boundary can effectively move from the hardware device to the user's decision.

This is one reason the industry increasingly emphasizes clear signing — displaying meaningful transaction information on a trusted device so users can independently verify what they are authorizing.

Ledger itself highlighted clear signing as an important defensive measure following the incident. (Ledger)

The Human Element

Perhaps the most important lesson is that sophisticated infrastructure can still be undermined by a single compromised credential.

The former employee's access had been removed from Ledger's internal systems during offboarding, but access to the external NPMJS service had not been revoked.

Ledger subsequently identified this as a weakness in its offboarding process and said it was reviewing access controls across its internal and external services. (Ledger)

This illustrates a broader cybersecurity principle:

Identity lifecycle management matters just as much as network security.

Organizations need to know not only which employees can access internal systems, but also which external services, repositories, package registries, SaaS platforms and developer tools remain connected to those identities.

What Crypto Users Should Learn

The Ledger incident offers several practical lessons for anyone holding digital assets.

1. Never blindly approve transactions

A wallet prompt should never be treated as a routine confirmation.

Users should understand what they are signing, particularly when interacting with unfamiliar DApps or smart contracts.

2. Verify transaction details independently

When possible, use a trusted hardware-wallet display to verify the destination, asset and transaction details before approving.

3. Be cautious with token approvals

Token approvals can provide contracts with permission to move assets. Users should periodically review and revoke unnecessary permissions where appropriate.

4. Keep wallet software and applications updated

Security fixes and improvements are regularly released across wallet software and connected applications.

5. Treat unexpected wallet requests as suspicious

Urgency, unexpected approval requests, fake claims and unusual signing prompts are common characteristics of cryptocurrency attacks.

6. Protect the recovery phrase

No legitimate support representative should need a wallet's recovery phrase.

Anyone who obtains a recovery phrase may be able to control the associated wallet.

The Bigger Picture

The Ledger Connect Kit incident was not simply a story about one compromised developer account.

It was a demonstration of how interconnected the cryptocurrency ecosystem has become.

A wallet, DApp, browser, package registry, authentication credential and smart contract can all form part of the same security chain.

If one link is compromised, the consequences can extend far beyond the original system.

That is why Web3 security increasingly requires a defense-in-depth approach: strong identity controls, secure software-development practices, dependency monitoring, transaction simulation, clear signing, user education and continuous security testing.

Ledger continues to publish security research and advisories through its Donjon security team, including security bulletins addressing vulnerabilities affecting its products and ecosystem. (Ledger Donjon)

Final Thoughts

The Ledger Connect Kit incident remains an important case study for cryptocurrency security because it demonstrates that attackers don't always need to break encryption or steal a private key.

Sometimes, the more effective strategy is to compromise the software and trust relationships surrounding the user.

For crypto holders, the takeaway is straightforward:

Slow down. Verify what you are signing. Protect your credentials. And never assume that a familiar application or wallet prompt is automatically safe.

In Web3, security ultimately depends on every layer of the transaction — from the developer who publishes the code to the user who presses Confirm.

Security Disclaimer: This article is provided for cybersecurity education and awareness. It does not provide instructions for compromising wallets, stealing cryptocurrency, bypassing security controls, or conducting unauthorized attacks.

Sources: Ledger's official Security Incident Report and Ledger security research. (Ledger)