Home›Crypto›Market Structure›Ledger warns Coldcard exploit shows hardware wallet se…

Ledger warns Coldcard exploit shows hardware wallet security must evolve

Ledger CTO Charles Guillemet said certified hardware random number generators are key because AI is speeding up vulnerability discovery, while Coldcard losses have reached about $130 million.

Reported · Written up by our desk · Market Structure

Ledger says a recent exploit affecting the air-gapped Coldcard Bitcoin hardware wallet is a warning to the wider hardware wallet industry, even as it said its own devices were not impacted. Decrypt reports that Ledger CTO Charles Guillemet pointed to the incident as evidence that hardware security models depend on how wallets generate cryptographic randomness.

The problem Decrypt describes traces to a March 2021 Coldcard firmware build, where a flaw led the device to rely on a software fallback instead of its hardware random number generator to create wallet recovery seeds. According to the report, that design issue made some private keys guessable and enabled thefts, with losses reaching roughly $130 million and other cases still under investigation.

Ledger argues that independently certified hardware random number generators are essential for securely producing wallet recovery phrases, and says its own wallets generate recovery phrases differently. Guillemet told Decrypt that Ledger draws its root secret, the 24 word Secret Recovery Phrase, from a true hardware random number generator inside a certified Secure Element with no software fallback path, using the full 256 bits of entropy for every seed.

Beyond the specific incident, Ledger says the broader evaluation of hardware wallet security needs to account for how quickly issues can be found. Decrypt reports Guillemet said AI is accelerating vulnerability discovery, and he noted that open source and reviewed code are not the same, adding that defense must move at machine speed.

Latest closeBitcoin $64,436.01 ▲1.5%

More like this

Sources