'Backdoor' in Ledger? Here's What's Going On—And How to Keep Your Crypto Safe - Decrypt (2024)

We do the research, you get the alpha!

Get exclusive reports and access to key insights on airdrops, NFTs, and more! Subscribe now to Alpha Reports and up your game!

Go to Alpha Reports

Decrypt’s Art, Fashion, and Entertainment Hub.

Discover SCENE

A contentious new feature has been added onto all Ledger hardware wallet devices. On Tuesday morning, the announcement had Crypto Twitter buzzing.

Although advertised several weeks back in a Wired article, today’s release brought the fire from the crypto community. The feature in question is Ledger Recovery, an ID-based private key recovery service would allow users to backup their private seed phrase directly to their personal identity through three different custodians. The service will cost $9.99 per month.

A seed phrase is a list of words which store all the information needed to recover the cryptocurrency in your hardware wallet, if it’s lost or stolen. But remembering the 12-word phrase—typically made up of random words—can be challenging. So most people either write it down or store it in a flash drive, or other storage device.

Despite the company adamantly stating that this is a voluntary service, and users can continue to back up their seed phrases themselves, Ledger owners are still unsettled over what this means for the hardware wallet company's security.

AD

Is there actually a backdoor in Ledger now?

The company claims there is no backdoor on its devices, and that this is an entirely opt-in service. That means if users don’t opt-in, it will have no effect on their Ledger devices.

Nicolas Bacca, co-founder of Ledger, spoke during a Twitter Space with several other Ledger executives. He was adamant that “this is not a backdoor at all, because nothing will happen without your consent on your device.” He also said the update does not increase attack vectors on Ledger wallets.

But there's been a lot of debate on Twitter over whether just the possibility of opting into the service presents its own security risk.

"The code path to send private key material over the internet will be on your device, whether you opt in or not," wrote Twitter user 0xfoobar. "Hackers can take advantage of this, and software bugs more likely to leak. Ledger’s business trajectory is one of wanton disregard for customer safety."

AD

AD

Solana co-founder Anatoly Yakovenko weighed in, saying he doesn't think much has changed about owning a Ledger device implying that users trust the company not to access their private keys.

"If you trusted them before not to exfiltrate your keys, you can trust them now not to do it when that feature is off," he wrote on Twitter. "I think the attack surface is about the same."

Should I switch wallets?

Which wallet to use depends on each individual user. It relies on your level of knowledge of proper private key management and personal responsibility.

Some users prefer paper wallets and others go mobile-first. Hardware wallets are recommended for safely storing large amounts of crypto, with some choosing joint custodial solutions–which refers to having three or more associated private keys, requiring a certain number of them (two of three, for example) in order to authorize a transaction. It stops any one person from unilaterally authorizing a transaction.

Given Ledger Recover is an opt-in service, users that decide not to use it, will not experience any changes to their seed phrase management on their devices.

What other hardware wallets are available?

There are a number of different hardware wallets on the market, each with their unique designs and security features.

For Bitcoin-only users, the main options are: Passport (by Foundation Devices), ColdCard, and BitBox02.

For all around crypto users, the main alternatives to Ledger are: Trezor, CoolWallet, and KeepKey.

AD

AD

Why do people use hardware wallets?

Hardware wallets are physical devices that store your private keys in a secure offline environment. They are considered by security and Bitcoin experts around the world as the safest option for guarding your crypto.

Whether you should buy one is a personal question, although famed Bitcoin educator Andreas M. Antonopoulos explains that “if you have more crypto than you would be upset to lose, you should use a hardware wallet.”

When it comes to crypto custodial options, everything comes down to personal preference.

Charles Guillemet, CTO at Ledger, said today on Twitter, that “this update is for my mother, for example, who isn’t comfortable with storing her private keys herself”, adding that the company is and will always be “security and self-custody maxis.”

Today’s newest addition to the Ledger stack will not affect those who don’t opt-in, although the timeless adage “do your own research” seems to be more prevalent than ever.

Stay on top of crypto news, get daily updates in your inbox.

'Backdoor' in Ledger? Here's What's Going On—And How to Keep Your Crypto Safe - Decrypt (2024)

FAQs

Is Ledger safe backdoor? ›

Ledger denies the existence of any backdoor on its devices and maintains that this is an entirely opt-in service. According to Nicolas Bacca, co-founder of Ledger, nothing will happen without the user's consent, and the update does not increase the attack vectors on Ledger wallets.

What was the Ledger hack? ›

The hack impacted multiple Ethereum-based decentralized applications (DApps), including Zapper, SushiSwap, Phantom, Balancer, and Revoke. cash. The malicious code employed a fake WalletConnect to redirect funds to the hacker's wallet, affecting any user attempting to connect to these DApps.

Is it safe to keep your crypto on a Ledger? ›

Using your Ledger device for cold storage allows you to take advantage of Ledger's security model. Ledger devices store your private keys offline on a Secure Element chip, an industry-grade computer chip resistant to physical hacks.

What's happening to Ledger? ›

The Ledger connector vulnerability put the entire DeFi ecosystem at risk, with market experts asking users to remain cautious of using DApps even after Ledger released a patch. Members of the crypto community shared their sentiments about the Ledger Connect exploit a day after the hack.

Can you still get hacked with a Ledger? ›

How can individuals protect themselves from potential scams or theft of their cryptocurrencies? While hardware wallets like the Ledger Nano S are generally considered more secure than software wallets, they are not completely immune to hacking or theft.

Has a Ledger wallet ever been hacked? ›

That's when an attacker injected malicious “drainer” code into Ledger's Connect Kit, a widely used software component maintained by the hardware wallet maker. For a few hours before it was patched, the malicious code snatched digital assets right out of wallets connected to services through Connect Kit.

Can crypto be stolen from Ledger? ›

Segregate Your Assets

Ledger devices can only protect you so far. If you sign a malicious transaction with your Ledger, your funds will still be at risk. To avoid someone stealing your crypto, the best thing you can do is segregate your assets correctly.

Does Ledger have hidden wallets? ›

Attaching a passphrase to a new PIN code creates a new set of secret accounts on your Ledger device based on a passphrase of your choice. You can access the accounts protected by this passphrase by entering a secondary PIN code. Only one passphrase can be attached to a PIN code.

What is the most secure hardware wallet? ›

Trezor hardware wallets keep your crypto safe from hackers, malware, and other threats by keeping sensitive data offline, keeping your crypto safe 24/7. With easy wallet backup, your funds are always recoverable, no matter what happens.

Is Ledger safer than Coinbase? ›

Another highly important aspect is the Security Level - it can tell you how safe your crypto assets will be if stored in a certain wallet. After doing Coinbase vs Ledger comparison, it's evident that Coinbase has somewhat better security features than Ledger.

How do I make sure my Ledger is safe? ›

Only interact with Ledger support throughout on our official support pages. Our team will never DM you through social media or any other avenue of digital communication. Never share your 24-word seed phrase with anyone. Also, never digitize, take a picture of, enter into a hot wallet, or screenshot, your seed phrase.

Where is the best place to store crypto Ledger? ›

Hardware wallets are considered the most secure way to store your crypto. This is because your private keys, which allow for the spending of your crypto, physically cannot leave the hardware wallet device due to how hardware wallets are designed.

What will happens if Ledger goes out of business? ›

A: All you'd need is your original seed phrase you save when setting up your ledger. With that seed phrase you can recreate all wallets your ledger device creates. Ledger is giving ease of use with this but by no means are you reliant on them for your money if they went bankrupt one day. That's the beauty of crypto!

What happens if Ledger company shuts down? ›

If TREZOR, Ledger, Coldcard or any other wallet or hardware wallet company go out of business, you can use any other wallet to recover your wallet. The 12 or 24 words you wrote down at the beginning when you got your wallet can re-create your wallet without the need for the hardware wallet company you bought from.

Is Ledger really worth it? ›

Ledger offers a range of hardware wallets that allow you to store your cryptocurrencies offline. This protects your assets against potential online threats. These wallets are highly secure and reliable. They come with a variety of features, including Bluetooth connectivity, native staking, and NFT management.

Does Ledger have access to my keys? ›

You must write down your 24-word recovery phrase precisely and in the correct order before storing it securely. Never enter your recovery phrase on any other device. Anyone who gets your recovery phrase can take your crypto assets. Ledger does not store your private keys, nor ever asks for it.

Is it safe to buy from Ledger resellers? ›

Ledger has authorized resellers that are trusted to not compromise your wallet before shipping. Amazon is an authorized reseller in most countries. However, make sure you are having your order being fulfilled by Amazon itself, not a third party selling on Amazon.

Top Articles
Latest Posts
Article information

Author: Zonia Mosciski DO

Last Updated:

Views: 6057

Rating: 4 / 5 (51 voted)

Reviews: 82% of readers found this page helpful

Author information

Name: Zonia Mosciski DO

Birthday: 1996-05-16

Address: Suite 228 919 Deana Ford, Lake Meridithberg, NE 60017-4257

Phone: +2613987384138

Job: Chief Retail Officer

Hobby: Tai chi, Dowsing, Poi, Letterboxing, Watching movies, Video gaming, Singing

Introduction: My name is Zonia Mosciski DO, I am a enchanting, joyous, lovely, successful, hilarious, tender, outstanding person who loves writing and wants to share my knowledge and understanding with you.