Ledger says attacker conducted phishing attack on former employee

The Ledger attacker was able to upload the malicious code to ConnectKit after phishing a former Ledger employee

article-image

Quinten Jacobs/Shutterstock modified by Blockworks

share

Today’s attack on crypto hardware firm Ledger was traced to an ex-employee who “fell victim to a phishing attack that gained access to their NPMJS account” in an email to Blockworks.

The code was then published to ConnectKit. A fix, according to Ledger, was deployed roughly 40 minutes after they were alerted but not before the malicious code was active for five hours.

The address was connected to a malicious code found in Ledger’s ConnectKit software libraries early Thursday. ConnectKit connects blockchain apps with Ledger devices. 

Loading Tweet..

WalletConnect was able to disable the “rogue project.” Chainalysis posted the address and Tether CEO Paolo Ardoino said his team froze the Ledger exploiter address. 

Loading Tweet..

Ledger told Blockworks that it is working with customers impacted by the attack as well as law enforcement to track the attacker. 

The attack led to SushiSwap and Revoke.cash taking their front-end web apps offline. As Blockworks previously reported, Revoke.cash was impacted by the attack. SushiSwap warned users to avoid interacting with the Sushi page.

Ledger, following the warnings across social media, previously updated that it was able to replace the malicious file with the genuine one.

Loading Tweet..

“In the meantime, we’d like to remind the community to always Clear Sign your transactions — remember that the addresses and the information presented on your Ledger screen is the only genuine information,” Ledger continued. 

The hardware firm added that users should stop the transaction “immediately” if there’s a difference between the Ledger device screen and the screen on a computer or phone.


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Decoding crypto and the markets. Daily, with Byron Gilliam.

Upcoming Events

Javits Center North | 445 11th Ave

Tues - Thurs, March 24 - 26, 2026

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

Unlocked by Template (1).jpg

Research

As AI supercharges surveillance, privacy becomes a prerequisite and the winning stack will combine confidentiality with selective disclosure. Zcash’s Tachyon, composable standards on Ethereum/Solana, and compliance-aware pools aim to make private rails the new norm.

article-image

The derivatives giant will extend futures and options access to round-the-clock trading in early 2026

by Blockworks /
article-image

Global fiber network goes live as SEC clears 2Z token for utility use

by Blockworks /
article-image

The SPAC transaction positions Avalanche Treasury Co. as a Nasdaq-listed vehicle for institutional AVAX exposure by 2026

by Blockworks /
article-image

The collaboration brings regulated money market fund exposure to Polygon, with custody provided by Standard Chartered

by Blockworks /
article-image

FG Nexus teams with Securitize to bring its Nasdaq-listed equity onchain, offering tokenized stock trading through Ethereum

by Blockworks /
article-image

Sponsored

Taiko launches binding onchain governance and appoints three directors with expertise in global regulation, business strategy and blockchain tech

by Sponsored /