Attackers compromised a former Ledger employee's NPMJS account via phishing and published malicious versions of Ledger Connect Kit (1.1.5, 1.1.6, 1.1.7) containing Angel Drainer malware. The code rerouted user transaction approvals through rogue WalletConnect instances for less than two hours before detection.

the Ledger Connect Kit suffered a supply chain attack, with attackers stealing at least $600,000. The SlowMist security team immediately initiated an analysis of the relevant code and discovered that the attackers implanted malicious JavaScript code in versions @ledgerhq/connect-kit=1.1.5/1.1.6/1.1.7. They directly replaced the normal window logic with a Drainer class, triggering not only a fake DrainerPopup popup but also handling the transfer logic for various assets. Attackers launched phishing attacks against cryptocurrency users through CDN.