Ledger Exploit Endangers DeFi; Sushi Says 'Do Not Interact With ANY dApps'

The exploit reportedly prompts users to connect their wallets via a pop-up, triggering a token drainer.

AccessTimeIconDec 14, 2023 at 12:48 p.m. UTC
Updated Mar 9, 2024 at 2:16 a.m. UTC

Sushi's Chief Technology Officer warned of an industry-wide exploit related to a Ledger's Connect Kit as the decentralized finance (DeFi) protocol was hit by a front-end exploit.

Ledger, a maker of hardware wallets, provides Connect Kit software that decentralized finance protocols such as Lido, Metamask and Coinbase, along with Sushi, use to connect decentralized applications (dapps) to its products. By compromising the front end of a website or application, hackers can alter functions users see and con them into inadvertently sending cash to the exploiters rather than their own wallets.

“Do not interact with ANY dApps until further notice,” Sushi CTO Matthew Lilley wrote on X. “It appears that a commonly used web3 connector has been compromised, which allows for injection of malicious code affecting numerous dApps.”

The exploit reportedly prompts users to connect their wallets via a pop-up, which then triggers the token drainer. Issues have also been reported across other DeFi websites, including Zapper and RevokeCash.

Five hours after the hack, Ledger published a post-mortem on X. It confirmed that a former Ledger employee fell victim to a phishing attack, which allowed a hacker to insert malicious code into Ledger's Connect Kit. It adds that the code has now been removed and stablecoin issuer Tether has frozen the hacker's wallet.

"We've identified a critical issue the ledger connector has been compromised, potentially allowing the injection of malicious code affecting various dApps," Sushi wrote in a statement. "If you have the Sushi page open and see an unexpected 'Connect Wallet' pop-up, DO NOT interact or connect your wallet."

One X user pointed out that Ledger’s library had been compromised and replaced with a token drainer.

Ledger said it had "identified and removed a malicious version of the Ledger Connect Kit."

"A genuine version is being pushed to replace the malicious file now," Ledger said. "Do not interact with any dApps for the moment. We will keep you informed as the situation evolves. Your Ledger device and Ledger Live were not compromised."

UPDATE (Dec. 14, 13:23 UTC): Adds context throughout.

UPDATE (Dec. 14, 14:49 UTC): Adds statement from Ledger.

UPDATE (Dec. 14, 15:00 UTC): Rewrites headline; changes lead photo.

UPDATE (Dec. 14, 15:58 UTC): Adds statement from Ledger.

Edited by Parikshit Mishra and Sheldon Reback.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Oliver Knight

Oliver Knight is a CoinDesk reporter based between London and Lisbon. He does not own any crypto.