Ledger Connect Kit hack
A December 2023 software supply-chain attack: a phished former Ledger employee's npm key let attackers publish malicious versions of Ledger's widely used 'Connect Kit' library, injecting the Angel Drainer into many dApps. About $500K–$600K was drained in a few hours before a fix shipped.
Also known as: Ledger Connect Kit, Ledger Connect Kit hack, @ledgerhq/connect-kit
Summary
On December 14, 2023, attackers compromised the npm publishing credentials of a former Ledger employee (via phishing) and published malicious versions (1.1.5–1.1.7) of Ledger's "Connect Kit," a JavaScript library used by hundreds of decentralized apps to connect wallets. Because many sites loaded the library from a CDN at runtime, the malicious code propagated automatically. [1][2]
Impact
The injected code carried the Angel Drainer payload, prompting users of affected dApps to sign transactions that drained their wallets; proceeds were split ~85% to the attacker and ~15% to Angel Drainer. Active draining lasted roughly two hours (about five hours total exposure), with losses estimated around $500,000–$600,000 before Ledger shipped a clean version (1.1.8) and coordinated with Tether to freeze some funds. The incident underscored supply-chain risk in widely shared web3 dependencies. [1][2]
Bracketed numbers refer to the numbered sources listed below.
Sources (2)
See also
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
HEX / PulseChain (Richard Heart)ProjectsCrypto projects (HEX, PulseChain, PulseX) created by Richard Heart (Richard Schueler). In July 2023 the U.S. SEC sued him for offering unregistered securities that raised $1B+ and for allegedly misappropriating ~$12M for luxury goods (including a 555-carat diamond). A court dismissed the case in 2024 for lack of U.S. jurisdiction; there was no finding of wrongdoing and Heart denies the allegations.
This page was last updated on Jun 30, 2026. View revision history.
