I Thought Ledger and Coldcard Cared About Security

Imagine you’re sitting at home drinking a beer after a long day’s work when your friend calls to tell you something’s wrong with your new Ledger wallet. Your heart skips a beat, and your eyes flitter. 

Not again, you think, remembering that the Coldcard fiasco was only three months ago.

So you sign into X/Twitter and see the news. French-based Ledger has been hit by a supply chain attack. (That’s when hackers tamper with a product before it reaches the person who’s going to use it.) The authorized reseller that you, gulp, bought your device from has been installing hidden spyware to steal your private keys. 

Unconfirmed reports say around $86 million has been drained. Of course, Ledger still hasn’t acknowledged the scale of the damage, and, in a move that would make even the greenest marketing department head say tsk-tsk, you see they’ve gone ahead with a new product launch. The day after the attack became public. LOL. 

Then they issue a shoddy statement with platitudes like “we are with you,” or, in Coldcard’s case, we find out they’ve been spending all their time dilly-dallying with AI instead of protecting your money.

It hits you. Yet another company whose entire business model (and thus, marketing spiel) is about making sure nobody but you can take your money…doesn’t care that someone has taken your money. 

Really? Can crypto’s industry leaders actually be this incompetent? 

Coldcard

Let’s run it back a few months to the Coldcard fiasco.

Before I whip up my tinfoil hat and join my fellow conspirators on Twitter, I should note that what I think went down was just a spectacular case of incompetence on the company’s developers’ part. 

Or maybe that’s what I choose to believe. 

Anyway, in July this year, a Reddit user claimed their Bitcoin, held on a Coldcard device, had been sent to another wallet by someone who wasn’t them. If only that had been all. Within hours, thousands of people realized they were also affected. 

Once the dust settled, 1,816 Bitcoin, or around $120 million, was lost. 

Wait, what? I thought Coldcard was the bee's knees of Bitcoin custody. All the Bitcoin podcasts I listened to told me the company was the gold standard for security and that I didn’t need to know how to verify their software to know I was in good hands. 

But in 2021, Coldcard developers apparently introduced a bit of software that came with a bug in the random generator that created seed phrases on their devices. In other words, the randomness that was meant to protect your Bitcoin wasn’t truly random.

Oops. 

Ledger

Ledger’s case is different, but the company is no less culpable.  

To help get its devices to crypto investors worldwide, the company partners with authorized resellers. That way it doesn’t have to set up the (probably pretty costly) distribution itself. 

No worries—until one of its authorized resellers went rogue. CryptoBilis, a company based in Malaysia, received genuine Ledger devices, took them apart, and installed spyware that sent critical recovery information to the attackers. 

The critical information included seed phrases that attackers could use to drain unsuspecting wallets—to the tune of nearly $100 million.

But this wasn’t Ledger’s fault (as it argues in this post): 

“There was no flaw in Ledger’s chip, operating system or servers. Ledger’s systems were not compromised,” wrote the company. “This was an attack on the distribution channel after the devices left our control.”

Like hell it isn’t. Isn’t the entire company predicated on the idea that it will direct every smidgeon of effort to making sure nobody gets away with customers’ money? Isn’t it responsible for properly vetting authorized resellers? And isn’t its responsibility to then constantly and consistently audit those resellers? 

If they fail at any of those along the way, shouldn’t they be held responsible? 

To many readers, it may seem like I’m unaware of all the moving parts involved in security. But Ledger is valued at $1.5 billion, and it last raised $109 million in 2023. 

Surely it has the funds to at least put a minimally competent supervising team in charge of ensuring every device it sells—no matter whether through the official website or a vendor—hasn’t been tampered with.

Or have we forgotten the adage “don’t trust, verify”?

By the way, this isn’t the first time Ledger has acted with disregard for your security. Its first blemish came in 2020, when a massive data breach exposed over one million e-mail accounts and around 272,000 records of personal information on the dark web. 

Back then, much like today, Ledger downplayed the incident. After issuing an apology, the company understated the eventual number of customers whose physical addresses were exposed. Meanwhile, customers quickly became targets of phishing scams and other threats. 

So Ledger made a few changes to its data-retention and customer-security policies. But no victims received any reparations from the company. 

Cheers, Ledger.

Of course, security incidents are bound to happen—on both sides. Customers will make mistakes and so will companies. Especially in an industry still trying to get rid of its training wheels. But what we can’t have are companies that break the most basic of all their promises and then take no action to amend the wrongs. 

The fact that Coldcard continues to publish about security on social media is galling. That Ledger went ahead with a product launch the day after their incident is appalling. 

This time, an apology isn’t enough. 

You had one job. But apparently it was too much to handle.