Worked example · 2023-12

Ledger Connect Kit Library Supply-Chain Compromise — multi-chain (EVM dApps) — 2023-12-14

Loss: approximately $600K in confirmed on-chain losses during the approximately 4-hour exposure window before the malicious library version was removed. The loss figure is limited relative to the exposure surface (every dApp that loaded the compromised Connect Kit library during the window) because the attacker's drainer integration required the user to interact with the malicious prompt; many users who loaded the compromised library did not complete the drain interaction. The structural risk surface — a compromised communication layer between hardware wallet and dApp — is significantly larger than the realised loss suggests.
Recovery: no confirmed recovery. Tether froze the attacker's USDT address approximately 4 hours after the compromise was detected; some portion of the drained funds were blocked at the Tether issuer level. The broader drained assets (ETH, ERC-20 tokens not subject to issuer-level freezes) were not recovered. Ledger committed to making affected users whole, with the reimbursement scope announced in the days following the incident.
OAK Techniques observed: OAK-T11.006 (Cold-storage Seed-phrase Exfiltration at Rest — broadly construed; the Connect Kit compromise is structurally a cold-storage-bridge compromise: the hardware wallet device itself and the seed phrase stored on it were never compromised, but the software communication layer between the dApp and the hardware wallet was controlled by the attacker). OAK-T15.002 (Supply-Chain / Vendor-Pipeline Compromise — the load-bearing primitive: a malicious version of the @ledgerhq/connect-kit npm package was published to the public npm registry, replacing the legitimate library with attacker-controlled JavaScript that injected a crypto drainer into every dApp that loaded the compromised version). OAK-T4.001 (Permit2 / On-Chain Drainer Integration — the downstream extraction primitive: the malicious library injected a wallet-drainer payload into the dApp's frontend, soliciting transaction approvals from connected users that redirected their assets to attacker-controlled addresses).
Attribution: pseudonymous at the direct-attacker level. The entry vector was a phishing attack against a former Ledger employee whose npm publish credentials were compromised; the attacker used the compromised credentials to publish the malicious library version. The public record does not name the specific individual or group behind the phishing attack. The broader attribution chain connects to the Angel Drainer group through the wallet-drainer payload's on-chain fingerprint; Angel Drainer is a known drainer-as-a-service operator active on the Russian-language cybercriminal forum ecosystem (OAK-G03-adjacent). Ledger confirmed the phishing-entry-vector attribution in its post-incident disclosure.
Key teaching point: A hardware wallet's security model extends only to the boundary of the hardware device — the software communication layer between the dApp and the hardware wallet is a custody surface that, if compromised, structurally defeats the hardware wallet's isolation guarantees. The user's mental model is "my funds are safe because my seed phrase never leaves the hardware wallet," but the Connect Kit compromise demonstrates that the communication layer can be compromised independently of the hardware device, and a compromised communication layer can solicit transaction approvals from the hardware wallet that the user did not intend — the hardware wallet faithfully signs what the compromised software asks it to sign. The structural OAK lesson is that cold-storage compromise surfaces extend beyond the hardware device's physical and firmware boundaries to include every software component in the signing path — the npm libraries, the dApp frontend, the wallet-connect relay, and the browser extension — any of which can be compromised independently of the hardware wallet.

Summary

On December 14, 2023, a malicious version of the Ledger Connect Kit library (@ledgerhq/connect-kit) was published to the public npm registry. The Ledger Connect Kit is a JavaScript library that dApps integrate to enable wallet connection with Ledger hardware wallets — it is the software bridge between the dApp's frontend and the user's hardware wallet, handling the communication protocol, the transaction-construction UI, and the prompt-to-sign workflow. The library is loaded by hundreds of dApps across the EVM ecosystem and is a critical dependency in the Ledger hardware-wallet user workflow.

The entry vector was a phishing attack against a former Ledger employee. The employee's npm publish credentials — which had not been revoked after their departure from Ledger — were compromised through the phishing attack. The attacker used these credentials to publish version 1.1.8 of @ledgerhq/connect-kit (and subsequently versions 1.1.5, 1.1.6, and 1.1.7, which were also malicious) to the npm registry. The malicious library versions injected a crypto drainer payload into any dApp that loaded the library — when a user connected their wallet through the compromised Connect Kit, the drainer injected a transaction prompt that redirected the user's assets to attacker-controlled addresses.

The exposure surface was every dApp that loaded the compromised library version during the vulnerability window. The window was approximately 4 hours — from the initial malicious publish to npm at approximately 08:00 UTC to the removal of the malicious versions from npm at approximately 12:00 UTC. During this window, any dApp that performed an npm install @ledgerhq/connect-kit (or whose CDN-pinned version auto-updated to the malicious version) loaded the compromised library. The attacker's drainer payload was a standard wallet-drainer integration — it solicited a transaction approval from the connected wallet, and the hardware wallet, seeing a legitimate transaction prompt from the Connect Kit (which the user had authorised as the communication layer), signed the transaction. The user's hardware wallet never left the user's possession; the seed phrase never left the secure element. The funds were extracted regardless, because the communication layer that bridged the dApp to the hardware wallet was under attacker control.

Ledger detected the compromise and responded within hours: the malicious library versions were removed from npm, a clean version (1.1.8, republished without the malicious payload) was deployed, and Ledger published a post-incident disclosure confirming the phishing-entry-vector attribution. The incident triggered a broader industry conversation about npm-supply-chain security for wallet-communication libraries — a class of dependency whose compromise structurally defeats hardware-wallet isolation regardless of the hardware wallet's physical security.

For OAK's purposes, the Ledger Connect Kit compromise is a boundary case between T11.006 (Cold-storage Seed-phrase Exfiltration at Rest), T15.002 (Supply-Chain Compromise), and T4.001 (On-Chain Drainer Integration). The structural classification that most precisely captures the failure mode is T11.006 broadly construed: the hardware wallet's seed phrase was never exfiltrated, but the communication layer that bridged the dApp and the hardware wallet was compromised, and that communication-layer compromise is structurally analogous to cold-storage exfiltration at rest — the attacker gained control over the signing path without touching the seed phrase. The npm-supply-chain entry vector (T15.002) is the load-bearing attack primitive; the wallet-drainer payload (T4.001) is the downstream extraction primitive. The case extends the T11.006 surface beyond the "seed-phrase material at rest in third-party storage" framing (LastPass, iCloud) to include "communication-layer compromise between dApp and hardware wallet" as a structurally analogous T11.006 surface.

Timeline (UTC)

When	Event	OAK ref
Pre-incident	Former Ledger employee's npm publish credentials remain active post-departure; no credential-revocation workflow is triggered on departure	(standing T15.002 surface)
2023-12-14 (prior to T+0)	Attacker phishes former Ledger employee's npm credentials	T15.002 entry vector
2023-12-14 ~08:00 UTC	Malicious `@ledgerhq/connect-kit` library versions (1.1.5, 1.1.6, 1.1.7, 1.1.8) published to npm registry; any dApp performing `npm install` during the window loads the compromised library	T15.002 malicious publish
2023-12-14 ~08:00 to ~12:00 UTC	dApps loading the compromised Connect Kit inject a wallet-drainer payload into user interactions; users connecting hardware wallets through the compromised library are prompted to sign drainer transactions	T4.001 drainer integration / T11.006 cold-storage-bridge compromise
2023-12-14 ~12:00 UTC	Ledger detects the compromise; malicious library versions removed from npm; clean version deployed	(response)
2023-12-14 ~12:00 UTC	Tether freezes attacker's USDT address; ~$600K in confirmed on-chain losses across ETH, ERC-20 tokens (USDT portion frozen; remainder not recovered)	(containment)
2023-12-14 onward	Ledger publishes post-incident disclosure; commits to making affected users whole; industry-wide conversation about npm-supply-chain security for wallet-communication libraries	(disclosure + industry response)

Realised extraction

Approximately $600K in confirmed on-chain losses across ETH and ERC-20 tokens during the approximately 4-hour exposure window. The extraction profile is limited relative to the exposure surface because (a) the exposure window was short (~4 hours), (b) the drainer payload required active user interaction (transaction approval on the hardware wallet), and (c) not all dApps that loaded the compromised library during the window had active user sessions. Tether froze the attacker's USDT address within hours, blocking a portion of the extraction; the non-USDT portion (ETH, other ERC-20 tokens) was not recovered. Ledger committed to making affected users whole; the reimbursement program is the primary recovery path for affected users.

The structural lesson is that the exposure surface — every dApp that loads the Connect Kit, for every user who connects a Ledger hardware wallet through that dApp — is orders of magnitude larger than the realised extraction. If the malicious library had remained on npm for 24 hours rather than 4, or if the attacker had used a more sophisticated drainer payload that did not require active user interaction (e.g., exploiting a pre-existing token approval), the realised loss would have been substantially larger. The incident is a near-miss at the dollar-extraction level, but the structural T11.006 / T15.002 lesson — that the hardware-wallet communication layer is a custody surface independent of the hardware device — is load-bearing regardless of the extraction figure.

References

Ledger post-incident disclosure (December 14, 2023) — primary incident disclosure; phishing-entry-vector attribution; npm-credential-revocation gap acknowledged.
MetaMask / WalletConnect security advisory — wallet-communication-library dependency analysis; npm-supply-chain risk characterisation for wallet-integration libraries.
Blockaid / Web3 security-firm analysis — on-chain drainer-payload fingerprinting; Angel Drainer attribution at the drainer-contract level.
Tether freeze announcement — USDT freeze on attacker address; approximate 4-hour detection-to-freeze latency.
Industry press: CoinDesk, The Block, Decrypt — contemporaneous reporting; npm-supply-chain risk to wallet-communication libraries as a recurring class.
[npmsecurity2023] — npm-supply-chain-security research; credential-revocation and departed-employee access management as a recurring T15.002 surface.

Public references

See citations in corresponding technique file.

Discussion

The Ledger Connect Kit compromise is structurally important to OAK for two reasons. First, it extends the T11.006 surface beyond the "seed-phrase material at rest in third-party storage" framing. The existing T11.006 canonical cases (LastPass encrypted-vault exfiltration, iCloud-backup MetaMask seed-phrase cohort) share the feature that the seed-phrase material itself was stored in a third-party service and was exfiltrated at rest. The Connect Kit compromise demonstrates a structurally analogous T11.006 surface where the seed phrase itself is never exfiltrated — it remains securely on the hardware wallet's secure element — but the communication layer that translates the dApp's transaction request into a hardware-wallet signing prompt is under attacker control. In both cases, the attacker controls the signing path without holding the seed phrase; in both cases, the user's mental model of self-custody collapses because a third-party dependency (password manager in the LastPass case, npm library in the Connect Kit case) is the load-bearing custody surface.

Second, the incident demonstrates the npm-supply-chain surface (T15.002) as it applies specifically to wallet-communication libraries. The npm ecosystem is the dominant distribution channel for wallet-integration JavaScript libraries (Ledger Connect Kit, WalletConnect, Web3Modal, RainbowKit, wagmi). A compromised wallet-communication library structurally defeats the hardware-wallet isolation guarantee — the hardware wallet will faithfully sign whatever the communication library asks it to sign, because the communication library is the trusted intermediary between the dApp and the hardware wallet. This is a T15.002 surface that is structurally more dangerous than a generic npm-supply-chain compromise (e.g., a compromised logging library) because the compromised library is in the signing path — the exact component whose integrity the hardware wallet's security model assumes.

The departed-employee credential-revocation gap that enabled the compromise is a recurring T15.002 sub-pattern. The former Ledger employee's npm publish credentials remained active post-departure — a standard access-management failure that recurs across the T15 family (compare: the Atomic Wallet build-pipeline compromise, T11.002, where the compromised component was the software-distribution pipeline rather than the npm library). The defender lesson is that npm-publish-credential revocation on employee departure is a load-bearing T15.002 control whose absence creates a standing supply-chain-compromise surface regardless of the library's code quality or audit status.

The incident is classified at the T11.006 level (cold-storage communication-layer compromise) rather than purely at the T15.002 or T4.001 level because the structural failure mode — a compromised communication layer between dApp and hardware wallet — is a T11-specific surface that the existing T15.002 and T4.001 classifications do not fully capture. T15.002 describes the entry vector (npm-supply-chain compromise); T4.001 describes the extraction primitive (wallet drainer); T11.006 describes the trust-model failure — the hardware wallet's security model assumes the communication layer is trusted, and that assumption is the load-bearing vulnerability. The cross-classification is deliberate and preserves the structural nuance that a single-Technique classification would lose.