Ledger Hardware Wallet to Compensate Users with $600,000 Lost in Exploit

Ledger, the renowned hardware wallet provider, has declared its commitment to compensate users for the approximately $600,000 in assets lost in the recent ConnectKit exploit. 

In a statement issued on X (formerly Twitter) on December 20, Ledger assured victims that their lost assets would be reimbursed before the end of February 2024. The company has already initiated contact with impacted users, actively navigating the recovery process for a seamless compensation experience.

“We commit, by any way possible, including gestures of goodwill, to make sure this is done by the end of February, 2024. We are already in contact with many impacted users and are actively working through the specifics with them.”

The exploit targeted the user interfaces of various decentralized applications (dApps) utilizing Ledger’s ConnectKit, including prominent ones like Zapper, SushiSwap, Phantom, Balancer, and Revoke.cash. 

Acknowledging the severity of the situation, Ledger has urged users who signed transactions on the exploited dApps to revoke all authorized transactions promptly, minimizing potential risks associated with the breach.

We are 100% focused on following up to last week’s security incident, making sure incidents like this are prevented in the future, and that the ecosystem remains safe.

We are aware of approximately $600k in assets impacted, stolen from users blind signing on EVM DApps.

Ledger…

— Ledger (@Ledger) December 20, 2023

Ending Blind Signing: Ledger’s Security Enhancements

In response to the security breach, Ledger is reinforcing its commitment to enhancing security measures within its ecosystem. The company is collaborating with the dApp ecosystem to implement “Clear Signing” while discontinuing the Blind Signing feature from its devices by June 2024. 

Clear Signing, a new security feature, empowers users to scrutinize and verify transaction details directly on their Ledger devices before approval. This verification process, encompassing transaction amounts, recipient addresses, and other relevant details, enables users to make well-informed decisions, reducing the risk of unauthorized transactions.

“We are announcing that by June 2024, users will no longer be able to Blind Sign with Ledger devices. Our commitment is to work with the community and DApp ecosystem to allow Clear Signing so users can verify all transactions on Ledger devices before signing. This will lead to a new standard to protect users and encourage Clear Signing across DApps.”

said the statement.

The commitment to discontinue Blind Signing demonstrates Ledger’s proactive approach to mitigating potential vulnerabilities. The company has called upon dApp developers to prioritize user security by building applications that support the new Clear Signing feature. 

This collaboration between hardware wallet providers and dApp developers aims to establish a new standard that enhances user protection, and fosters trust in the decentralized ecosystem.

Ledger’s Response and Industry Impact

Following a high-profile hack, Ledger has emerged with a multi-faceted response plan. The exploit, stemming from a phishing attack on a former employee, compromised Ledger’s Connect Kit software. The malicious code injected during transactions with affected dApps redirected user funds to the hacker’s wallet.

Ledger’s pledge to reimburse all affected users, irrespective of whether they are Ledger customers, sets a significant precedent in the crypto industry. The company’s commitment to updating hardware wallets and discontinuing Blind Signing reflects a dedication to evolving security standards. 

By collaborating with the broader crypto community and dApp developers, Ledger seeks to fortify the industry against potential threats, setting a new user protection and transaction verification standard.