Ledger Commerce & Marketing Database Gets Leaked

Ledger’s hardware wallets have the most robust physical security on the market. To this day, nobody has been able to extract the seed words from the popular Ledger Nano S or the newer Nano X. But this kind of security is owed to a trusted setup which uses a closed-source secure element chip. In other words, you can’t verify what the device is doing and you must trust in Ledger with both your wallet xpub (so they know your public key and how many bitcoins you own) and security updates.

This “trust us” philosophy is a big part of the way in which Ledger operates as a company. But the recent news about Ledger’s database leaks should be concerning for all customers: on July 14th 2020 (which happens to be the French National Day), a security researcher has reported a data breach on the Ledger website.

The good news is that no customer has lost any coins. The bad news is that if you ever bought a Ledger hardware wallet from the official website, then your full name, e-mail address, shipping address, and phone number may have ended up in the hands of hackers.

Consequently, it’s likely that malevolent actors will contact you and ask for private information – or if you hold enough BTC to make the extra effort worthwhile, some people may even try to physically attack you. Just remember that Ledger will never ask you for information concerning your seed phrase, PIN number, or private keys.

Also, they most likely won’t ask you to confirm your home address and definitely won’t suddenly decide to send you a free hardware wallet if you tell them where you live. So if anyone ever contacts you and asks for such data, never reply to their message. It’s better for them to think that your e-mail address is inactive.

Furthermore, it’s important to be careful and never install any suspicious software update. Smart hackers will try to target you and ask that you install a critical security update on your Ledger Nano S or X. Never trust these sources and stay away from any update that doesn’t come from the Ledger Live software. Don’t fall for phishing or malware scams, as you may lose your coins.

The situation is very similar with the case of exchange hacks which target customer data and enable the hackers to extort coins directly from the owners. Ledger has done a poor job protecting your personal information, so you shouldn’t be surprised if you get contacted by all sorts of dubious people.

Ledger CEO Pascal Gauthier assures users that the company has taken immediate action in appealing to the CNIL (Commission nationale de l’informatique et des libertés, the governmental branch which deals with personal data over the internet) and filing documents to the French public prosecutor. But even if the hackers get caught and they face justice, your data is still out there and you never know who ends up getting it and using it for malevolent purposes. So please be careful if you think you might be targeted.

How can you securely buy a hardware wallet?

Buying a hardware wallet online can expose you to database hacking risks. But buying the same device from unauthorized sellers may also subject you to supply chain attacks. So what is the best way to securely buy a hardware wallet?

Well, the best answer is “Bitcoin conferences”. Most of the times, hardware wallet manufacturers will attend conferences and sell hardware wallets. This direct purchase won’t be registered under your name, you can pay in cash or bitcoins, and being in a crowd of Bitcoin enthusiasts also gives you a lot of plausible deniability – it’s not like you put a target on your back just because you purchase a Trezor or Ledger in plain sight.

The second best answer is “look for local authorized resellers”. If you check the Ledger website, you’re going to find a list of authorized retailers. Though it’s also a bad idea to order hardware wallets from their online stores, they sometimes also have physical stores where you can go and do your shopping. And in some cases (such as Amazon’s), their record of handling customer data is slightly better in terms of getting hacked – yet the fact that Amazon might share your shopping list with advertisers that can also get hacked should also be a concern.

Even if it costs more in some cases, it pays off in terms of privacy and peace of mind to purchase your hardware wallet from a physical store that doesn’t ask for your personal information. The experience should be as simple as dropping the device in your cart among a pile of other electronic-related devices, and then paying at the counter.

And yes, it’s convenient to order your hardware wallet directly from the manufacturer’s website. We’re in the middle of a pandemic, there are no Bitcoin conferences to make the process any easier, and sometimes we don’t have proper stores and distribution in our area of residence. Nonetheless, we should always consider the privacy tradeoffs and remember that privacy is the best gatekeeper of security – if nobody knows about it, then nobody can attempt to hack it.

Donate to the Bitcoin Takeover Project

If you’d like to support my work, then please donate BTC to this address:

3MUN6pTt6rY8tyNPrdCxTSWisN1GQXzkLL

If prefer the Lightning Network, you may use Tippin or Tally Coin.

And if you’re more into dirty criminal and blood-stained fiat, then Patreon is definitely your gig.