Hundreds of thousands of dollars in crypto stolen after Ledger code poisoned

Ledger's Connect Kit NPM package was hijacked after a former employee fell for a phishing attack that allowed an attacker to publish malicious versions (1.1.5–1.1.7) containing a crypto-drainer. The malicious release was live for a short window (active ~2 hours), during which attackers stole roughly $610k–$850k from victims; Ledger patched and published a safe version (1.1.8), identified the attacker's address, and reported token freezes and notifications to authorities. The incident exposes weak distribution practices (CDN unpinned delivery), missing NPM two-factor authentication and access revocation gaps, increasing supply-chain risk for projects that automatically fetched the latest Connect Kit release.