On December 14, 2023, Ledger experienced a security incident involving $600k in assets. A phishing attack targeted one of its employees, leading to unauthorized access to the NPMJS account and the publication of a malicious version of Ledger Connect Kit. Ledger has since resolved the incident and published an incident report detailing the events.

Ledger is committed to assisting affected users, with support expected to be provided by the end of February 2024. As a precautionary measure, Ledger is working with dApp developers to transition from Blind Signing to Clear Signing, with Blind Signing to be phased out by June 2024. This transition aims to enhance security and enable users to verify transactions they consent to.

Users are urged to exercise caution when engaging with dApps and to report any suspicious activity. Ledger devices and Ledger Live were not exposed to exploitation and remain safe for use.

Ledger's proactive measures, including the adoption of Clear Signing, have been well-received by the community. Pascal Gauthier, Chairman and CEO of Ledger, addressed the incident promptly and assured users of ongoing investigations.

The incident report does not specify whether a single attacker was involved or if multiple attackers collaborated. However, it identifies the malware used as Angel Drainer, which deceives users into signing unauthorized transactions.

Looking ahead, Ledger plans to conduct third-party audits on code promotion, access control, and distribution, in addition to security training sessions and internal security programs. The dApps ecosystem is expected to comply with the transition to Clear Signing by June 2024, with Ledger's Security and Technology teams overseeing access control. Users are reminded to safeguard their Secret Recovery Phrase and to reject unidentified transactions.