Curriculum·Orientation·O101
After a Loss
The FBI's Internet Crime Complaint Center 2024 annual report.6 billion in reported losses, a third more than the year before.
Lesson 1 opens on
The Ledger Connect Kit supply chain attack, December 2023
On 14 December 2023 an attacker took over the npm account of a former Ledger employee and published malicious versions of Ledger Connect Kit, a JavaScript library that decentralized applications embed in their front ends to talk to wallets. Any user visiting an affected site during the window was served a wallet drainer disguised as the normal connect prompt. The malicious file was live for about five hours, and Ledger deployed a fix within about 40 minutes of becoming aware of it.
Jurisdiction · as of 2026-09
Reporting and tax treatment in this course are United States federal, as they stood on the date beside this line: the FBI's IC3 and the IRS. Reporting routes and any deduction differ by country. The evidence file it tells you to keep is the same everywhere.
The lessons
- O101-01The first hourIdentify, from what happened, which secret or permission is compromised: a seed, a device, an approval, an exchange login or a signed messageabout 30 min · opens on The Ledger Connect Kit supply chain attack, December 2023
- O101-02What is and is not recoverableDistinguish tracing from recovery, and explain why a theft that is fully visible on the chain is usually still goneabout 29 min · opens on The FBI Internet Crime Complaint Center annual report for 2024
- O101-03Reporting, and the tax treatmentFile a report that can be acted on: where, in what order, with what attached, and what to expect backabout 29 min · opens on IRS Chief Counsel memorandum 202511015, March 2025
- O101-04The second waveRecognize a recovery scam on first contact from the shape of the offer, before any detail is checkedabout 30 min · opens on FBI IC3 public service announcement on fictitious law firms targeting cryptocurrency scam victims, June 2024