Supply chain attack on Ledger puts much of defi at risk
web3isgoinggreat.com
A supply chain attack on the Ledger connector application has rippled throughout the world of decentralized apps, which widely use the software to enable people to connect their popular Ledger hardware wallets to perform transactions. Although hardware wallets are meant to be among the most secure ways to store crypto, they too are vulnerable to attacks when they are connected to perform transactions.A hacker was able to obtain access to Ledger's source code management tool and push out a new release that contained code that would drain wallets as users connect them. Because the library is so widely used, many crypto applications were vulnerable — including Revoke.cash, a security-focused project intended to help people guard against attacks on their wallets.CTO of the Sushi crypto project issued a broad warning: "Do not interact with ANY dApps until further notice." At least $600,000 has been drained from multiple users so far.
  • Steve@awful.systemsEnglish
    1·
    11 months ago

    crypto reminds me of this time I was working for a digital agency and we landed a huge project to build a new from-scratch version of Australia’s biggest job site of the time. The delivery timeline was 3 months or so, but we kept going over. Each month we went over gave the client more time to change their mind on what had been built so far. The more they changed what was built the more bugs were created. By 8 months in it was clear that jira tickets were being created about 5x faster than they were being closed. Everyone knew it was impossible to finish. It became a standoff between agency and client to see who would give in first. We kept building and they kept throwing money at us. At one point our boardroom became a makeshift desk for 12 contractors.

    Eventually the client gave in at the 12-month mark and had to sign-off on a successful delivery because our contract was written well enough to account for the effects of their meddling. We handed over a non-functional site and a couple of months later they paid another agency to re-skin their existing site.

    Anyway… crypto and the idea that “we’ve just got to fix the bugs” reminds me of that.

  • bitofhope@awful.systemsEnglish
    1·
    11 months ago

    You’re laughing. A supply chain attack on the Ledger connector application has rippled throughout the world of decentralized apps, which widely use the software to enable people to connect their popular Ledger hardware wallets to perform transactions, and you’re laughing.

  • Soyweiser@awful.systemsEnglish
    0·
    11 months ago

    At least $600,000 has been drained from multiple users so far.

    As far as crypto heists go that isn’t much.

    • froztbyte@awful.systemsEnglish
      2·
      11 months ago

      I’ve been watching the last few and the numbers stay low. Not much money left in the casino, it would seem

      • Soyweiser@awful.systemsEnglish
        0·
        11 months ago

        I think the thefts are priced in the value of the stolen coins so this says nothing about the liquidity. No idea how to properly look that up (and last time I tried it was oddly hard to find data on it, and the changes of it over time)

        • David Gerard@awful.systemsOPMEnglish
          1·
          11 months ago

          illiquid shitcoins are the order of the day. putting a spurious $ value on them is part of the scam. comes back to completely fuck them when it’s prosecution time tho, cos the $ values immediately push the crime into the highest sentencing bracket. here’s to mark-to-market!

          • Soyweiser@awful.systemsEnglish
            2·
            11 months ago

            In .nl the higher the crime bracket the more resources the police/persecution can also use to go after that crime (that is at least it was a while ago) why all dutch computer crime had pretty high prison times, as else they simply couldn’t be policed. Wonder if they also get themselves in trouble like that.