On 14 December 2023, three malicious versions of the Ledger Connect Kit library were published to npm after a former Ledger employee was phished, according to Ledger's own incident report. The root cause Ledger names is access that was not revoked during offboarding. A genuine version was deployed within 40 minutes of Ledger becoming aware.
What was Connect Kit?
Connect Kit is a JavaScript library that decentralized apps load to connect to Ledger hardware wallets. Many apps pulled it through a content delivery network, so a bad version could reach users without any app changing its own code. That distribution pattern is the core of the lesson.
What is the timeline?
All times below are CET on 14 December 2023, from Ledger's incident report.
- Morning. A former Ledger employee fell victim to a phishing attack. The report says the phishing did not focus on credentials but worked directly on the session token.
- 09:49, 10:44 and 11:37. Malicious versions 1.1.5, 1.1.6 and 1.1.7 were published to npm.
- 13:45. Ledger learned of the attack, prompted by outside parties.
- 14:18. Ledger's technology and security teams were alerted.
- 14:55. Tether froze the attacker's USDT at Ledger's request.
- Fix. The report gives no clock time, but says a genuine version was deployed within 40 minutes of Ledger becoming aware. It also says CDN caching kept the malicious file available for longer.
Fireblocks, a security vendor, gives an exposure window of about five hours, roughly 10:30 to 14:35 UTC, and says the fixed release was version 1.1.8. It describes the victim as a Ledger developer; Ledger's report says former employee.
Where do the reports disagree or stay silent?
Ledger's report is not fully consistent about how two factor authentication was bypassed. The timeline points to the session token, while the root cause section says the attacker circumvented the measure by exploiting an API key. The report does not reconcile the two. Treat the exact mechanism as unsettled.
Ledger's page gives no total loss figure. It says a low volume of users signed malicious transactions. Other outlets published estimates that vary, and we do not repeat them here because we did not verify them.
What can defenders learn?
Offboarding must cover registry access. Ledger names the cause as the former employee's npm access not being revoked when other access was. Add package registries, CI secrets and API keys to the leaver checklist.
Publishing accounts are crown jewels. Whatever the exact bypass, a stolen session or key defeated a second factor on the account. Prefer phishing resistant authentication, limit and rotate API keys, and review who can publish.
Do not load mutable code at runtime from a shared path. Apps that loaded the library dynamically inherited the bad version. Pin versions, host your own copy and verify integrity where you can.
Know where third party code loads. Inventory scripts loaded in the browser from CDNs, not only package manifests.
Watch for unexpected releases. Alerts on new versions of critical dependencies shrink the window between publish and notice.
Practice the fix. Replacing a bad version quickly was what ended the exposure. Rehearse that path, including cache purges.
What to do
- Add registry, CI and API key access to your offboarding checklist and audit it quarterly.
- Require phishing resistant multi factor authentication for every account that can publish packages.
- Review and rotate registry API keys; remove unused ones.
- Pin dependencies and avoid loading mutable scripts from public CDNs without integrity checks.
- Alert on new releases of your most critical dependencies.
- List every browser side script that touches wallets, payments or logins.
- Rehearse swapping a dependency version within an hour.
Safeguard's Gold registry and package checks can help you review a dependency before you adopt a version, but they do not replace account security at the registry.
Quick check
What does Ledger say was the root cause?
That the former employee's npm access was not revoked during offboarding, though other access was.
Would pinning versions have helped?
For apps that bundled a fixed version, yes. Apps that loaded the library dynamically picked up the bad one.
Sources
Last reviewed: 18 October 2026.
