作者：极客Web3，来源：作者推特@eternal1997L
刚才，Ledger Connect Kit的npm库1.1.5/1.1.6/1.1.7被黑客攻击，其中植入了攻击逻辑。
Ledger Connect Kit是用于dApp连接Ledger钱包的一个库，被很多dApp集成，发布于Ledger的npm管理网站JSDELIVR上。
Ledger在该网站的账户被盗，黑客将该库替换为了有害版本。
在本次攻击的文件中可以看到，黑客直接用Drainer类替换了正常的窗口逻辑。
Drainer顾名思义就是榨取器，不仅会弹出伪造的DrainerPopup弹窗，也会处理各种资产的转账逻辑。
在Drainer类的start()方法中，会检查该钱包的余额，如果小于黑客设置的minimalDrainValue=0.001
主币，则不会启动攻击。
显然，在任何常见的EVM系网络上，余额小于这个数的钱包都不太可能有任何有价值的资产，黑客也不想浪费时间。
然后开始搜索sweets“甜点”，也就是你的资产。
对不同的资产，黑客丧心病狂地布置了约30多个case，包括ETH/BSC/ARB等知名主网的主币和其上的知名项目的代币、NFT等，只要你有相应的资产，就会直接触发转账动作。
以其中transferNative()转走主币为例，虽然发送这一步还是要取得签名的，但中招的用户应该不少。
Ledger应对方法很简单：夺回账号控制权，更新库版本1.1.8，发布新库。
可以看到1.1.8的更新记录，没有任何实际内容，只有版本号变化，因为github上的代码库并没有出问题。
Ledger在发布新版本后，一是可以让开发者使用最新的1.1.8版本而非被黑客替换的版本，二是可以让用户检查是否正在使用有问题的版本。
修复方法
对用户而言，应访问先访问https://cdn.jsdelivr.net/npm/@ledgerhq/connect-kit@1 看看图中划出来这部分文字是否是1.1.8 ，或者更高的版本，如果是则表示安全。
如果不是，进入浏览器的开发者工具，清除缓存后完成修复。
对开发者而言，应该更新项目内的npm依赖。已经上线的项目的且不是在线动态引用库的项目，并且使用了有问题版本的，应该重新编译和部署。
Q：我不是Ledger用户，会不会受影响？
A：根据Ledger官方的介绍，这个库是用来连接Ledger钱包的。但黑客修改了弹窗逻辑，其他钱包用户也可能受影响。
Q：助记词或者私钥会被盗吗？
A：不会。不论冷钱包和热钱包，其keyring私钥管理模块都只在限定的场景内交出助记词和私钥（一般是用户要求查看助记词）。不可能暴露给任何其他函数调用。
This surge in network activity resulted in a spike in transaction costs, soaring to over 7,000 Gwei (up from 100 Gwei the previous day) before stabilising around at the lowest point at 400 Gwei, according to Polygonscan.
DavinThe Seoul High Court's 5th Criminal Division, under the guidance of Presiding Judge Seo Seung-ryeol, delved into an appeal hearing regarding fraud charges amounting to 110 billion won against former Chairman Lee Jeong-hoon. The prosecution urged a reconsideration of the initial ruling, pushing for an 8-year prison sentence identical to the first trial's decision.
JoyThe Monetary Authority of Singapore (MAS) has granted initial approval for a license, enabling XREX to offer digital payment token products and services in the city-state.
BrianU.S. authorities apprehend trio in a $10 million crypto fraud, exposing a scheme of bank theft and deceptive cryptocurrency conversion.
Hui XinUbisoft disclosed plans on the 17th to introduce NFTs through Ethereum's chain for their upcoming Web3 game, "Champions Tactics." The company also unveiled a scheme to provide select users with these NFTs for free.
JoyA couple operating aesthetic medicine clinics in Taichung City, Taiwan, faces legal repercussions due to their involvement in cryptocurrency mining ventures. Zheng and Su sought to bolster their income by investing in virtual currency mining since 2021. Collaborating with Huang, who established eight mining sites in Taichung, the couple engaged in mining operations. However, suspicions arose as Huang is accused of stealing electricity, resulting in losses of approximately NT$80 million for Taiwan Power Company. The situation escalated when two mining sites experienced electrical fires, posing risks to adjacent tutorial centres and a hot pot restaurant.
JoyMAS Managing Director Ravi Menon disclosed plans for the central bank to collaborate with local banks, testing the practical use of CBDCs as settlement assets for domestic payments.
DavinTurkey is implementing crypto regulations, prioritising licensing standards to address FATF concerns, ensure global compliance, and bolster its position in the crypto market.
Hui XinCanada's intelligence agency alerts to the growing threat of realistic deepfakes, urging global cooperation to address the risks posed by advanced AI technologies.
Hui XinXi Jinping's APEC summit attendance gathered dignitaries like Joe Biden, Elon Musk, and tech titans, with reports suggesting a lavish $40,000 dinner. Xi proposed business initiatives amid declining foreign investment, but a mix-up stole attention when CZ, mistaken for another, sparked lively crypto discussions. His humorous response lightened the unexpected twist.
Joy