Ledger Connector Vulnerability 🚨

[crypblizz8]

Sharing the statements, we posted on Twitter / X.

We are aware of a system vulnerability that is currently affecting users of Ledger’s connect-kit and wagmi’s LedgerConnector.

Users of affected apps are at risk of getting their wallets drained. As many of these apps also use WalletConnect SDKs, we are urgently requesting builders to check if your app is affected.

We are working with Ledger to get this resolved as soon as possible and will continue to share regular updates.

https://twitter.com/WalletConnect/status/1735293975739699506

Dapps using WalletConnect’s Web3Modal are not affected by the recent breach unless they have manually configured Ledger’s connect-kit or wagmi’s LedgerConnector.

We encourage dapps to upgrade to the latest version of wagmi’s LedgerConnector to fully remediate the issue, and strongly recommend users to avoid interacting with apps at this time.

https://twitter.com/WalletConnect/status/1735293975739699506

A fix has been deployed, and the genuine and verified Ledger Connect Kit version 1.1.8 is now propagating.
We have worked closely with Ledger to disable a project ID thought to have been used to target users with phishing attacks, and have reported the suspected address.

Dapps using WalletConnect's services and products will not have been directly affected, but we continue to remind any that also use Ledger's Connect Kit or wagmi LedgerConnector to update their version of these immediately.

In our mission of connecting Web3, safety is critical, which is why we continue to focus on establishing robust security features like Verify API to support a stronger, safer web3 for all. We will continue to work with Ledger to better understand the attack and urge the community to always remain vigilant when engaging with apps in web3.
https://twitter.com/WalletConnect/status/1735346187958432103
https://x.com/Ledger/status/1735326240658100414?s=20