Case period: 2023-12-14. This article is a retrospective review.
The historical record
Ledger's report of 20 December 2023 describes the compromise of Connect Kit on 14 December. The attacker obtained access through a former employee's npm session and published malicious package versions 1.1.5, 1.1.6 and 1.1.7. Applications loading that component could present malicious wallet requests to their visitors.
Where the trust boundary failed
This was a software distribution incident involving a connector used by applications. It should not be simplified into a claim that every Ledger device or Ledger Live installation was compromised. The vendor's report also distinguishes publication of the corrected package from the time needed for cached copies to stop circulating.
What this case teaches
A familiar application can serve an unsafe request when one of its dependencies changes. The signature screen remains a separate checkpoint: compare the asset, spender and amount with the action you initiated. For incident reporting, preserve the application URL, approximate time and transaction identifier. Those details help determine whether an interaction fell within the reported window. This retrospective relies on Ledger's account; Wallet Beep has not independently reconstructed the complete distribution or victim timeline.
Source and review date
Ledger — original source. Source published: 2023-12-20. Source checked: 2026-10-23.
This is an original Wallet Beep editorial summary. Consult the linked source for its full context and any later updates.