作者：极客Web3，来源：作者推特@eternal1997L
刚才，Ledger Connect Kit的npm库1.1.5/1.1.6/1.1.7被黑客攻击，其中植入了攻击逻辑。
Ledger Connect Kit是用于dApp连接Ledger钱包的一个库，被很多dApp集成，发布于Ledger的npm管理网站JSDELIVR上。
Ledger在该网站的账户被盗，黑客将该库替换为了有害版本。
在本次攻击的文件中可以看到，黑客直接用Drainer类替换了正常的窗口逻辑。
Drainer顾名思义就是榨取器，不仅会弹出伪造的DrainerPopup弹窗，也会处理各种资产的转账逻辑。
在Drainer类的start()方法中，会检查该钱包的余额，如果小于黑客设置的minimalDrainValue=0.001
主币，则不会启动攻击。
显然，在任何常见的EVM系网络上，余额小于这个数的钱包都不太可能有任何有价值的资产，黑客也不想浪费时间。
然后开始搜索sweets“甜点”，也就是你的资产。
对不同的资产，黑客丧心病狂地布置了约30多个case，包括ETH/BSC/ARB等知名主网的主币和其上的知名项目的代币、NFT等，只要你有相应的资产，就会直接触发转账动作。
以其中transferNative()转走主币为例，虽然发送这一步还是要取得签名的，但中招的用户应该不少。
Ledger应对方法很简单：夺回账号控制权，更新库版本1.1.8，发布新库。
可以看到1.1.8的更新记录，没有任何实际内容，只有版本号变化，因为github上的代码库并没有出问题。
Ledger在发布新版本后，一是可以让开发者使用最新的1.1.8版本而非被黑客替换的版本，二是可以让用户检查是否正在使用有问题的版本。
修复方法
对用户而言，应访问先访问https://cdn.jsdelivr.net/npm/@ledgerhq/connect-kit@1 看看图中划出来这部分文字是否是1.1.8 ，或者更高的版本，如果是则表示安全。
如果不是，进入浏览器的开发者工具，清除缓存后完成修复。
对开发者而言，应该更新项目内的npm依赖。已经上线的项目的且不是在线动态引用库的项目，并且使用了有问题版本的，应该重新编译和部署。
Q：我不是Ledger用户，会不会受影响？
A：根据Ledger官方的介绍，这个库是用来连接Ledger钱包的。但黑客修改了弹窗逻辑，其他钱包用户也可能受影响。
Q：助记词或者私钥会被盗吗？
A：不会。不论冷钱包和热钱包，其keyring私钥管理模块都只在限定的场景内交出助记词和私钥（一般是用户要求查看助记词）。不可能暴露给任何其他函数调用。
The FBI's cryptic response about the Bitcoin creator suggested he might be a 3rd party individual. The bureau’s ambiguous replies prompts speculation: does the FBI know Nakamoto’s true identity, or will the mystery persist?
KikyoThe Shiba Inu community, known for its large and active base, is increasingly targeted by scammers exploiting its popularity through fake airdrops and giveaways on Telegram and X. These scams aim to steal funds by tricking users into connecting their wallets or sharing personal information, capitalising on the community’s enthusiasm and trust.
AnaisReddio, a top parallel zkEVM Layer 2, has closed its seed funding round and is progressing with A-round financing to speed up its Layer 2 deployment. It has also integrated World ID from the Worldcoin network into its points system.
CatherineTON Ventures, led by Ian Wittkopp and Inal Kardan, has launched a $40 million fund to support early-stage projects on the TON blockchain. This move capitalises on Telegram's massive user base and aims to drive innovation in blockchain applications.
WeatherlyThe FTC's new rule bans fake reviews, AI-generated content, and paid bots to inflate follower counts, potentially starting in October. But can it truly eliminate fake online engagement or will it be akin to a drop in the ocean?
KikyoThe $DOGS token has rapidly gained popularity in the Telegram ecosystem, reaching over 50 million users and securing listings on major exchanges like Bitget, OKX, and Bybit. Its success is driven by Telegram's large user base and innovative marketing strategies, positioning it as a significant player among memecoins.
AnaisGrass, Wynd Network's flagship product, enables users to monetise unused network resources. As the AI DePIN project ends its Closed Beta, it launches a limited-time bonus epoch and hints at upcoming airdrop and tokenomics details, aiming to redefine internet connectivity.
CatherineFractal’s upcoming mainnet launch in September aims to transform Bitcoin’s scalability and programmability by introducing a native recursive scaling solution and smart contract functionalities. However, Bitcoin's recent decline amidst broader market gains and ongoing institutional investment raises questions about its short-term market stability and adoption of new technologies.
AnaisVitalik Buterin donated over $500K in animal-themed meme coins to charity, urging more practical utility for meme coins. Is this a genuine act of altruism or a strategic move to enhance his image while offloading coins?
KikyoIran is facing a severe power crisis worsened by illegal cryptocurrency mining, which consumes excessive electricity. To combat this, the government is offering a $24 reward for tips on unauthorized mining activities, but this may not address the underlying issues of power grid mismanagement.
Weatherly