“Everybody will be hacked”: Ledger’s warning puts wallet security to the test
Ledger CEO Pascal Gauthier’s warning that everyone will eventually be hacked came after attackers put hidden components inside genuine hardware wallets to capture recovery phrases. The incident brings the security question beyond the private key stored in a chip. A holder also depends on the device reaching them intact, the backup remaining private and the screen accurately explaining what they are about to approve.
- Ledger CEO Pascal Gauthier told Bloomberg on November 10 that perfect security does not exist. He defended self-custody while acknowledging that the principle applies to his own company.
- Ledger’s published response describes genuine devices modified after leaving its control. The company says hidden components were designed to capture recovery phrases during setup.
- Trezor issued a precautionary warning about a suspected implant in a Safe 5 bought through the same reseller. Its October 30 account distinguished the credible report from a completed laboratory examination.
- A stolen recovery phrase and a harmful signed transaction create different exposures. One can let another person recreate the wallet, while the other can authorise a specific transfer, approval or change in permissions.
- Recovery depends on what the attacker obtained and which assets moved. New hardware, revoked approvals, a token freeze and reimbursement address different stages of the loss.
“Everybody will be hacked at some point. Perfect security doesn’t exist,” Ledger CEO Pascal Gauthier said during a Bloomberg interview on November 10. He said the rule applied to Ledger as well as other companies.
The question put to him concerned thefts associated with modified hardware wallets. Ledger had already described a distribution attack in which criminals bought genuine devices, added hidden components and returned them to the sales channel. The company said the components were designed to collect the recovery phrase shown during setup.
That route matters because it reaches the information intended to rescue the owner after a device is lost. Once someone else has the required recovery material, they can recreate access elsewhere. The original wallet can keep working while the owner no longer has exclusive control.
The warning came with a defence of Ledger’s business
Ledger CEO Pascal Gauthier used the interview to argue that distributing custody across individual holders reduces the concentration of risk found at a large exchange. He compared the losses discussed by the interviewer with the much larger Binance theft and said the hardware wallet industry had lost a smaller proportion of the assets it protects.
Those figures were his comparative claim. An assessment of loss rates would need consistent periods, a clear measure of assets protected and an agreed method for attributing thefts. A large exchange’s reported assets and a hardware wallet manufacturer’s estimate of assets controlled by customers describe different populations.
A customer can use the same signing material with several devices. A wallet can hold assets on several chains. The manufacturer may not see all of those balances, while an exchange normally maintains its own customer ledger. That makes the denominator important when comparing percentages.
The interview also included an argument about attackers becoming more capable through AI. That can be relevant to phishing and impersonation, where criminals try to persuade a person to disclose a secret or approve an action. It does not explain the physical route used in a particular modified device.
The practical value of the warning is in the failure that follows it. A general statement about eventual compromise cannot tell a holder which action puts their funds at risk. The documented cases give a more specific account of what was exposed and why some familiar safeguards did not prevent it.
A genuine device can acquire extra hardware
Ledger’s October response places the modification after manufacture. It says the attackers retained genuine devices and fitted separate hardware designed to capture the backup during setup. The company describes the attack as occurring in the distribution channel.
Crypto.news reported Ledger’s confirmation of an unauthorised implant in an affected customer’s device. That physical finding is evidence about the examined unit. Estimates from blockchain researchers describe a larger set of suspected losses and should be read as their tracing results.
The reason genuine components matter is that an authenticity test can succeed on the component it checks. If the attacker leaves that component intact and adds another circuit, the check may establish that part’s origin without establishing the absence of added electronics.
An owner can therefore receive a device that behaves normally in routine use. The attacker’s goal may be to observe one sensitive moment during setup rather than change every transaction. Ledger’s published technical findings on the screen connection describe that route. A screen displaying the correct recovery words can expose them if an added observer can copy what the screen receives.
This changes the question a customer asks of the sales route. An authorised reseller relationship identifies a commercial channel. The incident shows why stock handling, returns and the path from the manufacturer to the buyer also belong in the security model.
Ledger’s response says returned devices must never be resold and describes tighter handling of stock. Crypto.news covered the new retail rules, including changes intended to reduce the opportunity to replace or alter displayed products. Those measures address the route into the owner’s hands.
Trezor’s warning concerned a separate reported device
Trezor’s October 30 notice described a Safe 5 bought through CryptoBilis. The company had received photographs and interviewed the reporter, but said it had yet to inspect the device in its own laboratory.
The report described an extra board between the main board and the screen, with a cellular component and antenna. Trezor treated it as credible enough to warn affected buyers. The company’s account made the purchase route central to its precautionary response.
That status needs to remain attached to the report. Ledger’s examined implant and Trezor’s reported device were at different stages of investigation in the published notices. A shared reseller does not itself establish that every device sold through it was changed.
Crypto.news’scoverage of the Trezor warning explains the company’s offer of replacement hardware for eligible buyers. The offer and the migration advice concerned exposure from devices supplied through that route. They were distinct from a general recall of every product the company makes.
The company asked customers to create a new wallet with a new backup where its guidance applied. That requirement follows from what the suspected component could observe. If the backup itself has leaked, another copy of the old signing setup does not remove the attacker’s access.
The backup can bypass the old device’s PIN
A PIN protects access to a particular device. A recovery phrase lets the owner restore the wallet after loss or damage. The same feature gives an attacker a route around the old device if the required recovery material is stolen.
Restoring a wallet on a replacement signer creates another way to use the same keys. It does not revoke the keys in the original device or in an attacker’s copy. The funds remain spendable under the same conditions until they are moved to a new arrangement.
The distinction is visible in an ordinary recovery. A person who loses a device can restore access without asking the network to authorise the new hardware. The chain checks whether a transaction satisfies the spending conditions, not which physical device produced the signature.
A change of PIN likewise affects the local signer. It does not change what a person holding the backup can derive elsewhere. A new case, a factory reset or a different brand of device can leave the original wallet’s keys controlling the same assets.
Trezor’s passphrase documentation describes an additional secret that can derive a separate wallet from the backup. The user needs the exact combination to reach that wallet. Losing the passphrase can also prevent the legitimate owner from recovering it.
The feature adds a dependency; its protection depends on how the secrets are entered and what a compromised setup can observe. It cannot substitute for understanding which material an incident exposed. If the attacker has everything needed for a wallet, changing where the owner stores one copy leaves that attacker’s copy usable.
A different backup format can preserve the same keys
Some wallets let the owner divide recovery material into shares. A threshold determines how many are needed. That can reduce the risk from losing or exposing a single stored share, depending on the scheme.
Trezor’s multi-share backup guidance explains that making a new backup arrangement for the same compatible wallet does not invalidate an earlier backup. Both can remain routes to the same wallet.
That is an important limit to an otherwise useful storage change. Better distribution of new shares can improve how the owner handles future loss or theft. It does not cancel a full backup that another person already copied.
A multisig wallet addresses a different part of the problem. Its spending rule can require several independent keys to authorise a transaction. If one is compromised, the attacker still needs the remaining threshold under the arrangement.
The signers have to be independent in practice. Several devices restored from the same single-signature seed are copies of one authority. They do not create several independent approvals. Storing several keys under one person’s immediate control can also concentrate a threshold that appears distributed on paper.
The relevant question is what the attacker would need to assemble. A stolen device, a copied phrase and a compromised shared computer can overlap in different ways. The wallet design matters alongside how its keys and backup information are actually handled.
A valid signature can still authorise the wrong action
Another class of theft does not require stealing the recovery phrase. A user can keep exclusive possession of the key and sign a request that gives someone else power over an asset. The resulting transaction can be valid under the chain’s rules.
A simple transfer authorises the specified recipient and amount. A token approval can give a spender permission to move assets later. A change to an account’s permissions can alter who can act for the account. Those are different consequences even when they are presented through the same wallet connection.
A hardware signer can protect the key from extraction while still carrying out an instruction the owner approves. The key’s isolation cannot tell the owner whether the website’s description matches the request being signed. That makes the information displayed before confirmation part of the protection.
Ledger’s clear-signing documentation describes the use of metadata that lets a device present supported transaction details in a readable form. Coverage depends on the chain, the request and the relevant integration. A supported device does not make every possible interaction readable automatically.
An owner also needs to distinguish a signature from a transaction already broadcast. Some signed messages can be submitted later by someone else. Closing the browser window after signing does not necessarily remove the permission the signature created.
Revoking a token approval can limit future use of that approval if the owner still controls the account and can submit the change in time. It does not reverse an earlier transfer. If the root signing material is compromised, the attacker may be able to make a fresh authorisation instead.
The screen is part of the decision
A transaction can reach a signer through a compromised computer or website. The display is intended to give the owner a way to check what the device is being asked to approve. Its usefulness depends on showing the details that determine the outcome.
For a transfer, those details include the asset, the destination and the amount. For a contract interaction, the important information can include the spender, allowance or role being granted. A familiar application name is less informative than the action the request would authorise.
Blind signing leaves more of the interpretation outside the device. The user may see data they cannot meaningfully verify and rely on the host application to explain it. Clear signing can improve that presentation for covered requests, but it still requires the owner to read the consequence and decide whether it matches their intent.
Simulation is another layer. A service can estimate what a transaction will do against a particular state. The estimate can help identify asset movements or permissions, while the actual execution still depends on the state and request that reach the network.
The distribution attack also puts a separate question to the screen. An added observer can target information shown during setup even if the transaction display is accurate later. Protecting the path from the key to the display and protecting the secrecy of the backup address different moments in the device’s life.
Ledger CEO Pascal Gauthier promoted a future product’s screen architecture in the Bloomberg interview. A product claim can identify what the company intends to change. Its actual protection against a known attack needs to be assessed against the delivered design and the conditions under which the attack can operate.
A frozen token is one step towards recovery
After a transfer, the available response depends on the asset and where it has gone. Some token issuers can restrict balances through their contracts. A native asset such as Bitcoin does not have the same issuer-controlled freeze mechanism.
A freeze can stop a specified token balance from moving. It does not itself decide who should receive it or complete a payment back to victims. Recovery can require a separate process to identify claims, establish authority and distribute the assets.
The attacker can also exchange the token before a freeze takes effect. A power over the original token does not automatically control the different asset received in the swap. The transaction history can remain visible even after the particular intervention point has passed.
A custodian can have another kind of control if proceeds reach an account there. It may restrict withdrawals under its policies and applicable law. A notice sent to a service, an account restriction and a return of funds remain separate events.
That distinction is useful when reading a loss total. Suspected stolen funds, balances still held in identified addresses and money actually returned to owners measure different stages. A replacement device addresses future hardware use. It does not by itself replace assets already taken.
The person responding also needs to establish whether the account is still under the owner’s control. An approval can sometimes be revoked. A changed permission threshold can prevent the original key from acting alone. A copied backup can let the attacker recreate access across several chains.
Why the loss comparison needs a common measure
Crypto.news covered the dispute between Ledger CEO Pascal Gauthier and former Mt. Gox CEO Mark Karpelès over warnings about modified devices. The disagreement highlights a problem with moving from a confirmed mechanism to a broad statement about relative safety.
A researcher can identify a set of addresses believed to be associated with an operation. That set can change as tracing develops. A manufacturer can inspect a device and identify a physical component. The two investigations can support each other without producing the same count.
One backup can control addresses on several networks. One person can hold several wallets. An address total therefore does not translate directly into a number of altered devices or affected buyers. The same limits apply when estimating the amount a manufacturer protects.
Comparing self-custody with an exchange also brings together different forms of risk. An exchange can suffer operational compromise, misuse customer assets or restrict access. A personal wallet can lose its backup, approve a harmful request or arrive with altered hardware. A single percentage can hide those distinct routes.
The practical comparison depends on the user. A person who can maintain independent backups and inspect signing requests may handle a wallet differently from someone who relies on an exchange’s account recovery. The existence of risks in both arrangements leaves a need to understand the actual control and recovery path in each.
Ledger CEO Pascal Gauthier’s statement is most useful when attached to that work. The evidence from the implant case puts distribution and backup exposure into the same discussion as chip security. The signing cases put readable approval information alongside key isolation.
What changes when security is treated as a sequence
A wallet reaches the owner, creates or restores keys, records a backup and signs requests. A failure at each step can give the attacker a different kind of authority. The corresponding response depends on whether the owner lost secrecy, approved a permission or lost access.
A new device can resolve a broken signer. A new key set can remove reliance on an exposed backup once assets are transferred. Revocation can address a live approval. An inheritance or recovery plan can help an authorised person regain access without handing immediate authority to everyone who knows it exists.
Those actions become clearer when the incident is described precisely. An implant capturing setup words calls for a different response from a spoofed page asking for a signature. A device authenticity result answers a different question from an inspection for added electronics.
The retail changes announced by Ledger and the migration advice issued by Trezor demonstrate the point. The companies addressed where hardware came from and which backup continued to control the wallet. The next technical disclosures can show how much of that route future designs and distribution controls will close.
Setup and everyday use have different points of exposure
The recovery phrase is unusually valuable because it can connect the setup of one wallet with control over many later transactions. A component that records the phrase once can give the attacker time to wait while the owner deposits more assets. The owner may see the device work normally during that period.
A harmful approval has a different timetable. The attacker may need the owner to sign after the account contains a particular token. The permission can remain in place until used or revoked under the contract’s rules. The loss can therefore occur well after the page that requested the approval has been closed.
An account-permission change can be more persistent still. If a chain permits thresholds and roles, the signed change can alter which keys are allowed to act. The owner may still hold their original secret while lacking the weight needed to make a corrective transaction alone.
These mechanisms call for different incident records. A suspected phrase leak starts with which wallets were derived from the material and which assets remain under those keys. An approval investigation starts with the spender, contract and allowance. A permission investigation starts with the account’s current signing rules.
The same distinction explains why a list of affected addresses can be incomplete at first. One phrase can generate multiple accounts and addresses. The owner or investigator may discover another affected chain later. A visible drain can reveal control without revealing every remaining target.
Separating savings from application use changes the exposure
A person can use one wallet for assets they rarely move and another for interacting with applications. The second account can hold only what is needed for the intended activity. If a token approval applies to that account, the assets in a separate account are outside that permission.
The benefit depends on how the keys are arranged. Several accounts derived from the same exposed recovery material can remain reachable by the same attacker. A distinction in the wallet interface does not necessarily create independent secrets.
A multisig savings arrangement can add a threshold before funds move. An application wallet may use a simpler signing route for frequent transactions. The trade-off is the additional work needed to keep the savings signers and recovery information accessible to the authorised people.
A threshold can also be weakened by common infrastructure. If several signers rely on the same compromised host to describe a transaction, they may approve the same misleading request. Independent keys reduce one route to loss, while readable transaction details address another.
The point is to identify what one compromise reaches. An approval should be assessed by its scope. A backup should be assessed by the accounts it can recreate. A shared device or service should be assessed by the signing and recovery roles it performs.
The incident creates a second opportunity for impersonation
A warning about compromised wallets can give criminals a convincing reason to contact owners. A message can claim to offer a replacement, a migration or a refund and direct the owner to a page that asks for the very secret the hardware was meant to protect.
Trezor’s notice explicitly warns that support will never request the recovery phrase. The replacement process concerns the physical device and the customer’s purchase route. A phrase entered into a remote form can give another person the means to restore the wallet.
A signature request can be disguised as a different kind of help. A page might ask the owner to prove control or verify eligibility. The relevant question is still what the request authorises and whether it creates a transferable permission rather than merely displaying an address.
The source of the request matters because an existing customer can have genuine reason to expect an update. Contact information exposed elsewhere can make a message more convincing without establishing that it came from the manufacturer. The owner’s previous relationship with a seller does not authenticate every later communication bearing its name.
A response programme should therefore make the next step easy to identify through the manufacturer’s published guidance. The purchase period, replacement terms and support route are more useful to an affected buyer than a general assurance about security.
What a future product has to demonstrate
A new architecture can address a known route of attack. To assess that claim, the relevant question is which information the attacker could previously observe and which component now protects it. The comparison needs to follow that path rather than rely only on the product category.
The same applies to software updates. An update may improve transaction interpretation or add coverage for another application. It cannot be assumed to remove added physical hardware or revoke a phrase already copied from a prior setup.
A useful technical disclosure would explain the attacker’s access, the observed data and the conditions needed for extraction. It could then show how the revised design changes one or more of those conditions. That lets users distinguish protection they can use now from a feature promised for later hardware.
Ledger CEO Pascal Gauthier’s November comments place that future work alongside the existing response. The immediate guidance still turns on the owner’s device, backup and signed permissions. The next products will be judged by how they protect those same points of authority.
What to Watch
- Technical disclosures: Published examinations can show what an implant observed and which parts of the device remained unchanged.
- Retail controls: Purchase routes, handling of returned stock and replacement terms determine how the response reaches affected buyers.
- Signing coverage: Wallet and application support determines which requests can display readable asset movements and permissions.
- Loss attribution: Device findings and address-based tracing should identify their own populations before they are combined into a loss estimate.
- Recovery transactions: Returned assets and documented distributions establish what holders recovered after any freeze or restriction.
FAQs
What did Ledger’s CEO say?
Ledger CEO Pascal Gauthier said everyone would be hacked at some point and that perfect security does not exist. He applied that statement to Ledger and defended the relative safety of self-custody. His comparison of loss rates remains the company’s argument.
Can a genuine hardware wallet contain an implant?
Ledger says genuine devices were modified in the distribution channel. Retaining original components can allow ordinary functions to continue while added hardware observes sensitive information. The findings concern examined devices and the identified route of sale.
Why does the recovery phrase matter if the key stays in the chip?
The phrase is designed to recreate access after a device is lost. Someone with the material required for the wallet can restore it elsewhere. They need not extract the original key from its chip or unlock the original signer.
Does changing the PIN remove the attacker?
A PIN change affects access to the device. It does not change a backup already copied elsewhere. The response to exposed signing material depends on moving assets to an arrangement the attacker cannot reproduce.
Can a hardware wallet stop a harmful approval?
It can protect the key and, for supported requests, show details before signing. The owner still has to judge the action. A valid signature can grant a token allowance or permission the owner did not intend.
Does clear signing cover every application?
Ledger’s documentation makes coverage dependent on supported networks, metadata and integrations. A request outside that coverage can still require blind signing. The owner needs to know what the device can actually display for the interaction in front of them.
Does a token freeze reimburse the owner?
A freeze restricts movement of the identified token balance. Returning value to victims is a further process. It needs an identified recipient, an allocation of claims and transactions that complete the return.
Did Trezor confirm the same attack as Ledger?
Trezor’s October 30 notice described a credible report awaiting its own laboratory examination. Ledger had published findings about a device it examined. The two accounts should retain those different evidentiary positions unless the manufacturers publish further results.
Disclaimer: This article is for informational and educational purposes only and does not constitute financial, investment, legal or tax advice. Cryptocurrency activities carry risks, including loss of funds. Readers should conduct their own research and consult a qualified professional where appropriate. Information is current as of November 11, 2026 and may change as technical investigations and product guidance develop.
