Ledger’s Response to Crypto Hack and Warnings on Social Media Bots

In the wake of the recent decline in BTC, a security breach in Ledger’s library exposed numerous smart contracts to potential vulnerabilities. Swift actions by certain protocols helped mitigate potential losses, and Ledger has unveiled plans to bolster security moving forward.

Ledger Crypto Breach: Safeguarding the Future

A malicious code within Ledger’s code library, a leading hardware wallet provider, rendered popular integrated protocols susceptible to attacks. Fortunately, the damage was limited to approximately $600,000, and Ledger has pledged to compensate those affected. They have issued the following statement:

“We are fully committed to addressing the recent hack, preventing future incidents, and ensuring the security of the ecosystem. We are aware of the approximately $600,000 in assets stolen from users of EVM DApps who unwittingly authorized transactions. Ledger is committed to compensating the impacted users and, by June 2024, collaborating with the DApp ecosystem to enable Clear Signing and discontinue Blind Signing with Ledger devices. We will provide compensation for damages in various ways, including goodwill gestures, by the end of February. We are in active communication with many affected users, finalizing the details together. We want to remind users that if they authorized transactions on affected DApps on December 14, 2023, following best security practices suggests canceling those authorized transactions to further mitigate the impact of malicious code. Starting June 2024, we announce that Blind Signing with Ledger devices will no longer be supported. We are committed to working with the community and DApp ecosystem to introduce Clear Signing, allowing users to verify all transactions on Ledger devices before confirming. This will establish a new standard for user protection and promote Clear Signing across DApps. Front-end attacks have plagued our ecosystem before and will persist. The most foolproof defense against such attacks is always verifying what you’re approving on your device. Clear Signing makes this possible, enabling you to see and confirm exactly what you’re signing on a secure screen. If the ecosystem continues to permit Blind Signing, users will remain at risk. We urge users to remain vigilant against phishing and scam attempts. We have only two legitimate social media accounts, and all others are fraudulent. ANYONE requesting your 24-word Secret Recovery Phrase is a criminal.”

Beware of Social Media Bots

The statement also underscores a prevalent threat: social media bots. These bots latch onto posts from X (formerly Twitter) accounts, offering assistance. For instance, if you post a query like, “How do I transfer Ethereum on MetaMask or Ledger?” these bots will bombard you with automated responses.

These accounts, leading you to fake addresses, Telegram accounts, or phone numbers, eventually pose as technical personnel from the relevant company and coax you into revealing your recovery words. Handing over your recovery words means relinquishing all assets in the associated wallet. Attackers target you precisely to pilfer these assets, even if you’re unaware of their intentions. Therefore, the recommended course of action is to promptly block any accounts requesting your recovery words or directing you to counterfeit websites.

Disclaimer: The information contained in this article does not constitute investment advice. Investors should be aware that cryptocurrencies carry high volatility and therefore risk, and should conduct their own research.

Post Views: 236