Inside the Ledger Connect Kit Supply Chain Breach: How a Single NPM Package Compromised the Web3 Ecosystem

The cryptocurrency world was shaken in mid-December 2023 when a sophisticated supply chain attack targeted the Ledger Connect Kit, a widely used JavaScript library that connects decentralized applications to Ledger hardware wallets. The breach resulted in the theft of approximately $600,000 in digital assets and exposed a critical vulnerability in how Web3 projects manage their software dependencies.

The Exploit Mechanics

The attack unfolded on the evening of December 14, 2023, when an attacker managed to push malicious versions of the @ledgerhq/connect-kit NPM package—specifically versions 1.1.5, 1.1.6, and 1.1.7. The attacker gained access by compromising a former Ledger employee through a phishing campaign, which provided the credentials necessary to publish the tainted packages to the NPM registry.

Once installed, the malicious code replaced the normal window logic with a Drainer class that triggered a fake popup interface mimicking the legitimate Ledger connection dialog. This rogue code handled the transfer logic for various crypto assets, silently redirecting user funds to the attacker-controlled wallet address. The malicious JavaScript was distributed via CDN, meaning any dApp that pulled the latest version of the library automatically served the compromised code to its users.

Security researchers at SlowMist identified that the code in version 1.1.5 referenced “Inferno,” believed to be connected to the Inferno Drainer phishing gang notorious for multi-chain scams. The subsequent versions contained additional obfuscated malicious payloads designed to evade detection.

Affected Systems

The reach of this attack was extraordinary because the Ledger Connect Kit is integrated into hundreds of decentralized applications. Among the platforms directly affected were Zapper, the DeFi asset management protocol whose front-end was first reported as hijacked; Sushi, the decentralized exchange whose CTO Matthew Lilley issued an urgent warning to users; Revoke.cash, the popular token approval management tool; and Kyber Network, the cross-chain DEX aggregator that disabled its front-end as a precaution.

Even MetaMask issued advisories, recommending users enable the Blockaid security feature before executing any transactions. The total losses were estimated at approximately $600,000, though the potential damage could have been far greater had the malicious packages not been detected and replaced within hours.

The Mitigation Strategy

Ledger responded swiftly once the breach was identified. The company pushed a genuine version of the Connect Kit to replace the malicious file on NPM and CDN. Ledger emphasized that the Ledger hardware devices themselves and the Ledger Live application were never compromised—the attack was purely a software supply chain issue affecting the JavaScript connector library.

The broader industry response included multiple dApps temporarily shutting down their front-ends, security teams auditing their dependency trees, and increased scrutiny of NPM package ownership and publishing credentials. This incident highlighted the cascading risks inherent in shared software dependencies across the Web3 ecosystem.

Lessons Learned

The Ledger Connect Kit attack demonstrated that even hardware wallet users are not immune to software-level compromises. Several critical lessons emerged from this incident:

Supply chain attacks are a systemic risk. A single compromised package can affect hundreds of downstream applications simultaneously. Web3 projects must implement rigorous dependency auditing and consider pinning specific package versions rather than always pulling the latest release.

Employee credential security matters. The initial compromise came through phishing a former employee whose access credentials were still active. Companies must have robust offboarding procedures that immediately revoke access to critical publishing infrastructure.

Speed of response is critical. The relatively contained losses—$600,000 rather than tens of millions—were largely due to rapid detection and response by the community and Ledger’s security team.

User Action Required

If you interacted with any dApps between December 14-15, 2023, consider the following steps: revoke all outstanding token approvals through a trusted interface, verify that your Ledger firmware is up to date through Ledger Live, enable transaction simulation features in wallets like MetaMask, and always verify the URL of any dApp before connecting your wallet. Bitcoin traded at approximately $42,270 at the time of this incident, and the broader crypto market capitalization stood near $1.64 trillion, underscoring the scale of assets potentially exposed to such supply chain vulnerabilities.

Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always conduct your own research and consult with security professionals regarding asset protection.