Ledger and Trezor Call for Responsible Disclosure of Security Vulnerabilities

ChainCatcher report: Hardware wallet manufacturers Ledger and Trezor are urging security researchers to adopt more responsible vulnerability disclosure practices. Charles Guillemet, Chief Technology Officer at Ledger, posted on X that artificial intelligence has made vulnerabilities easier to discover and exploit, but some researchers publicly disclose details before fixes are released—a practice he called “leveraging others’ risk for attention.” Guillemet urged researchers to first report vulnerabilities privately and agree on a timeline for remediation before disclosing details publicly, suggesting a common default window of 90 days, while noting that the timeframe can be adjusted flexibly based on vulnerability severity and the effort required for remediation. Jan Komárek, Head of Security at Trezor, told Cointelegraph that the 90-day period represents a commitment to manufacturers, not merely an obligation for researchers. He recommended that researchers first contact manufacturers to agree on a schedule; if the vendor fails to remediate within that timeframe, public disclosure may then be considered. This stance comes amid heightened scrutiny of hardware wallet security: the Coldcard theft involved over $100 million in assets, and a data breach at Trezor’s logistics provider compromised personal information of tens of thousands of customers.