An employee at Ledger was targeted in a phishing attack, leading to the deployment of a malicious version of Ledger Connect Kit. The compromised version was active for nearly 5 hours, during which funds were redirected for approximately 2 hours. Ledger's technical and support teams are actively assisting affected customers and are working to address the issue.

The affected versions of Ledger Connect Kit were identified as 1.1.5, 1.1.6, and 1.1.7. Ledger has since distributed the genuine version, 1.1.8, advising customers to wait at least 24 hours before resuming their use of the services. Meanwhile, investigations are ongoing, and Ledger has reported the incident to law enforcement.

In collaboration with WalletConnect, Ledger disabled the rogue project used by the hacker to divert funds to their account. Although MetaMask assured its community that MetaMask Portfolio and SDK users were unaffected, transactions were temporarily disabled for added security.

Ledger has deactivated the malicious code and released Ledger Connect Kit version 1.1.8, allowing customers to resume normal usage. It is recommended to prioritize clear signing and refrain from sharing the 24-word Secret Recovery Phrase with anyone.

While users can cautiously interact with dApps again, developers are advised to exercise caution. The community has expressed disappointment over the incident, highlighting the prevalence of malicious attacks in the crypto market. Nonetheless, the crypto market remains bullish, with Bitcoin, Ethereum, and Tether USDT leading the segment.

Pascal Gauthier, Ledger's CEO, has acknowledged the issue and reaffirmed the company's commitment to improving security measures. He emphasized the importance of clear signing in mitigating such issues in the future.