Worked example · 2023-12

Ledger Connect Kit Library Supply-Chain Compromise — multi-chain (EVM dApps) — 2023-12-14

Loss: approximately $600K in confirmed on-chain losses [thehackernews2023] (more than $600,000; other outlets give different figures, e.g. over $610,000 per ZachXBT as reported by TechRadar) — the malicious file was reachable for about five hours, and Ledger estimates the draining lasted under two hours [ledgerreport]. The loss figure is limited relative to the exposure surface (every dApp that loaded the compromised Connect Kit library during the window) because the attacker's drainer integration required the user to interact with the malicious prompt; many users who loaded the compromised library did not complete the drain interaction. The structural risk surface — a compromised communication layer between hardware wallet and dApp — is significantly larger than the realised loss suggests.
Recovery: no confirmed recovery. Tether froze the attacker's USDT at 2:55 PM CET, about an hour after Ledger became aware of the attack at 1:45 PM CET [ledgerreport]; the extent of what was blocked is not stated in the cited sources. The broader drained assets (ETH, ERC-20 tokens not subject to issuer-level freezes) were not recovered.
OAK Techniques observed: OAK-T15.004 (Operator Credential Compromise — primary. Per Ledger's incident report, a former employee was phished and the attacker used the resulting npm publishing access to push malicious @ledgerhq/connect-kit versions 1.1.5–1.1.7 [ledgerreport]. Package-registry publisher credentials are within T15.004's scope. See techniques/T15.004-operator-credential-compromise.md). OAK-T15.002 (Supply-Chain / Vendor-Pipeline Compromise — the compromised library was loaded by every dApp that pulled it, so one publish reached many front ends). OAK-T4.004 (Allowance / Approve-Pattern Drainer — the injected code was a wallet drainer; Ledger reports an 85/15 split between the exploiter and Angel Drainer [ledgerreport]).
Re-mapped 2026-10-11: primary Technique moved from T11.006 (seed-phrase exfiltration at rest — no seed was taken) to T15.004-operator-credential-compromise; merged with the duplicate 2023-12-ledger-connect-kit-library-supply-chain-compromise.
Attribution: pseudonymous at the direct-attacker level. The entry vector was a phishing attack against a former Ledger employee whose npm publish credentials were compromised; the attacker used the compromised account to publish the malicious library versions; Ledger's report says 2FA was bypassed using the individual's session token [ledgerreport]. The public record does not name the specific individual or group behind the phishing attack. The broader attribution chain connects to the Angel Drainer group through the wallet-drainer payload's on-chain fingerprint; Ledger's report describes Angel Drainer as a malware-as-a-service drainer, with stolen funds split 85% to the exploiter and 15% to Angel Drainer [ledgerreport]; the claim about forum activity previously made here is unsourced and removed. Ledger confirmed the phishing entry vector in its incident report [ledgerreport].
Corrected 2026-10-11: malicious versions were 1.1.5–1.1.7 (1.1.8 was the fix); exposure was about five hours (draining under two) on a CET timeline rather than a 4-hour UTC window; Tether froze about an hour after Ledger's awareness; unsourced reimbursement and Russian-forum claims were removed.
Key teaching point: A hardware wallet's security model extends only to the boundary of the hardware device — the software communication layer between the dApp and the hardware wallet is a custody surface that, if compromised, structurally defeats the hardware wallet's isolation guarantees. The user's mental model is "my funds are safe because my seed phrase never leaves the hardware wallet," but the Connect Kit compromise demonstrates that the communication layer can be compromised independently of the hardware device, and a compromised communication layer can solicit transaction approvals from the hardware wallet that the user did not intend — the hardware wallet faithfully signs what the compromised software asks it to sign. The structural OAK lesson is that cold-storage compromise surfaces extend beyond the hardware device's physical and firmware boundaries to include every software component in the signing path — the npm libraries, the dApp frontend, the wallet-connect relay, and the browser extension — any of which can be compromised independently of the hardware wallet.

Summary

On December 14, 2023, a malicious version of the Ledger Connect Kit library (@ledgerhq/connect-kit) was published to the public npm registry. The Ledger Connect Kit is a JavaScript library that dApps integrate to enable wallet connection with Ledger hardware wallets — it is the software bridge between the dApp's frontend and the user's hardware wallet, handling the communication protocol, the transaction-construction UI, and the prompt-to-sign workflow. The library is loaded by hundreds of dApps across the EVM ecosystem and is a critical dependency in the Ledger hardware-wallet user workflow.

The entry vector was a phishing attack against a former Ledger employee. The employee's NPMJS access had not been manually revoked during offboarding, and the phishing attack gave the attacker access to the account [ledgerreport]. The attacker published malicious versions 1.1.5, 1.1.6 and 1.1.7 of @ledgerhq/connect-kit to the npm registry; 1.1.8 was the clean fix [ledgerreport], [thehackernews2023]. The malicious library versions injected a crypto drainer payload into any dApp that loaded the library — when a user connected their wallet through the compromised Connect Kit, the drainer injected a transaction prompt that redirected the user's assets to attacker-controlled addresses.

The exposure surface was every dApp that loaded the compromised library version during the vulnerability window. The malicious files were published at 9:49, 10:44 and 11:37 CET, and remained reachable for about five hours because of CDN caching; Ledger estimates the draining itself lasted under two hours [ledgerreport]. During this window, any dApp that performed an npm install @ledgerhq/connect-kit (or whose CDN-pinned version auto-updated to the malicious version) loaded the compromised library. The attacker's drainer payload was a standard wallet-drainer integration — it solicited a transaction approval from the connected wallet, and the hardware wallet, seeing a legitimate transaction prompt from the Connect Kit (which the user had authorised as the communication layer), signed the transaction. The user's hardware wallet never left the user's possession; the seed phrase never left the secure element. The funds were extracted regardless, because the communication layer that bridged the dApp to the hardware wallet was under attacker control.

Ledger became aware of the attack at 1:45 PM CET (prompted by ecosystem actors including Blockaid) and responded: the malicious library versions were removed from npm, a genuine fixed version (1.1.8) was deployed within 40 minutes of Ledger becoming aware [ledgerreport], and Ledger published a post-incident disclosure confirming the phishing-entry-vector attribution. The incident triggered a broader industry conversation about npm-supply-chain security for wallet-communication libraries — a class of dependency whose compromise structurally defeats hardware-wallet isolation regardless of the hardware wallet's physical security.

For OAK's purposes, the Ledger Connect Kit compromise is a boundary case between T11.006 (Cold-storage Seed-phrase Exfiltration at Rest), T15.002 (Supply-Chain Compromise), and T4.001 (On-Chain Drainer Integration). The structural classification that most precisely captures the failure mode is T11.006 broadly construed: the hardware wallet's seed phrase was never exfiltrated, but the communication layer that bridged the dApp and the hardware wallet was compromised, and that communication-layer compromise is structurally analogous to cold-storage exfiltration at rest — the attacker gained control over the signing path without touching the seed phrase. The npm-supply-chain entry vector (T15.002) is the load-bearing attack primitive; the wallet-drainer payload (T4.001) is the downstream extraction primitive. The case extends the T11.006 surface beyond the "seed-phrase material at rest in third-party storage" framing (LastPass, iCloud) to include "communication-layer compromise between dApp and hardware wallet" as a structurally analogous T11.006 surface.

Timeline (UTC)

When	Event	OAK ref
Pre-incident	Former Ledger employee's npm publish credentials remain active post-departure; no credential-revocation workflow is triggered on departure	(standing T15.002 surface)
2023-12-14 (prior to T+0)	Attacker phishes former Ledger employee's npm credentials	T15.002 entry vector
2023-12-14 09:49, 10:44, 11:37 CET	Malicious `@ledgerhq/connect-kit` library versions (1.1.5, 1.1.6, 1.1.7) published to npm registry; any dApp performing `npm install` during the window loads the compromised library	T15.002 malicious publish
2023-12-14 morning to afternoon CET (about five hours reachable; draining under two hours)	dApps loading the compromised Connect Kit inject a wallet-drainer payload into user interactions; users connecting hardware wallets through the compromised library are prompted to sign drainer transactions	T4.001 drainer integration / T11.006 cold-storage-bridge compromise
2023-12-14 13:45 CET	Ledger becomes aware; malicious versions removed and a genuine fixed version (1.1.8) deployed within 40 minutes	(response)
2023-12-14 14:55 CET	Tether freezes the attacker's USDT at Ledger's request; loss reported as more than $600K by [thehackernews2023]	(containment)
2023-12-14 onward	Ledger publishes post-incident disclosure; commits to making affected users whole; industry-wide conversation about npm-supply-chain security for wallet-communication libraries	(disclosure + industry response)

Realised extraction

More than $600K in losses reported by [thehackernews2023] (figures vary by outlet) during the roughly five-hour exposure window. The extraction profile is limited relative to the exposure surface because (a) the exposure window was short (~5 hours, with draining under two hours), (b) the drainer payload required active user interaction (transaction approval on the hardware wallet), and (c) not all dApps that loaded the compromised library during the window had active user sessions. Tether froze the attacker's USDT at 2:55 PM CET [ledgerreport]; whether the non-USDT portion was recovered and whether Ledger reimbursed users are not stated in the cited sources.

The structural lesson is that the exposure surface — every dApp that loads the Connect Kit, for every user who connects a Ledger hardware wallet through that dApp — is orders of magnitude larger than the realised extraction. If the malicious library had remained on npm for much longer than about five hours, or if the attacker had used a more sophisticated drainer payload that did not require active user interaction (e.g., exploiting a pre-existing token approval), the realised loss would have been substantially larger. The incident is a near-miss at the dollar-extraction level, but the structural T11.006 / T15.002 lesson — that the hardware-wallet communication layer is a custody surface independent of the hardware device — is load-bearing regardless of the extraction figure.

References

Ledger post-incident disclosure (December 14, 2023) — primary incident disclosure; phishing-entry-vector attribution; npm-credential-revocation gap acknowledged.
MetaMask / WalletConnect security advisory — wallet-communication-library dependency analysis; npm-supply-chain risk characterisation for wallet-integration libraries.
Blockaid / Web3 security-firm analysis — on-chain drainer-payload fingerprinting; Angel Drainer attribution at the drainer-contract level.
Tether freeze announcement — USDT freeze on attacker address; Ledger's report puts the freeze at 2:55 PM CET, about an hour after it became aware.
Industry press: CoinDesk, The Block, Decrypt — contemporaneous reporting; npm-supply-chain risk to wallet-communication libraries as a recurring class.
[npmsecurity2023] — npm-supply-chain-security research; credential-revocation and departed-employee access management as a recurring T15.002 surface.

Public references

[ledgerreport] — Ledger, "Security Incident Report" (2023-12-14 incident): https://ledger.com/blog/security-incident-report
[thehackernews2023] — The Hacker News, "Crypto Hardware Wallet Ledger's Supply Chain Attack" (2023-12): https://thehackernews.com/2023/12/crypto-hardware-wallet-ledgers-supply.html
[slowmistledger] — SlowMist, "Supply Chain Attack on Ledger Connect Kit: Analyzing the Impact and Preventive Measures": https://slowmist.medium.com/supply-chain-attack-on-ledger-connect-kit-analyzing-the-impact-and-preventive-measures-1005e39422fd

Discussion

The Ledger Connect Kit compromise is structurally important to OAK for two reasons. First, it extends the T11.006 surface beyond the "seed-phrase material at rest in third-party storage" framing. The existing T11.006 canonical cases (LastPass encrypted-vault exfiltration, iCloud-backup MetaMask seed-phrase cohort) share the feature that the seed-phrase material itself was stored in a third-party service and was exfiltrated at rest. The Connect Kit compromise demonstrates a structurally analogous T11.006 surface where the seed phrase itself is never exfiltrated — it remains securely on the hardware wallet's secure element — but the communication layer that translates the dApp's transaction request into a hardware-wallet signing prompt is under attacker control. In both cases, the attacker controls the signing path without holding the seed phrase; in both cases, the user's mental model of self-custody collapses because a third-party dependency (password manager in the LastPass case, npm library in the Connect Kit case) is the load-bearing custody surface.

Second, the incident demonstrates the npm-supply-chain surface (T15.002) as it applies specifically to wallet-communication libraries. The npm ecosystem is the dominant distribution channel for wallet-integration JavaScript libraries (Ledger Connect Kit, WalletConnect, Web3Modal, RainbowKit, wagmi). A compromised wallet-communication library structurally defeats the hardware-wallet isolation guarantee — the hardware wallet will faithfully sign whatever the communication library asks it to sign, because the communication library is the trusted intermediary between the dApp and the hardware wallet. This is a T15.002 surface that is structurally more dangerous than a generic npm-supply-chain compromise (e.g., a compromised logging library) because the compromised library is in the signing path — the exact component whose integrity the hardware wallet's security model assumes.

The departed-employee credential-revocation gap that enabled the compromise is a recurring T15.002 sub-pattern. The former Ledger employee's NPMJS access had not been revoked at offboarding — a standard access-management failure that recurs across the T15 family (compare: the Atomic Wallet build-pipeline compromise, T11.002, where the compromised component was the software-distribution pipeline rather than the npm library). The defender lesson is that npm-publish-credential revocation on employee departure is a load-bearing T15.002 control whose absence creates a standing supply-chain-compromise surface regardless of the library's code quality or audit status.

The incident is classified at the T11.006 level (cold-storage communication-layer compromise) rather than purely at the T15.002 or T4.001 level because the structural failure mode — a compromised communication layer between dApp and hardware wallet — is a T11-specific surface that the existing T15.002 and T4.001 classifications do not fully capture. T15.002 describes the entry vector (npm-supply-chain compromise); T4.001 describes the extraction primitive (wallet drainer); T11.006 describes the trust-model failure — the hardware wallet's security model assumes the communication layer is trusted, and that assumption is the load-bearing vulnerability. The cross-classification is deliberate and preserves the structural nuance that a single-Technique classification would lose.