15-Year-old Finds Flaw in Ledger Crypto Wallet
Summary: Saleem Rashid, a 15-year-old researcher in the United Kingdom, found that an attacker with physical access to a Ledger hardware wallet could compromise its non-secure microcontroller chip to run malicious code, sidestep the device's firmware checks, and control the random number generator used to create backup codes for private keys. Ledger, which has sold over a million Nano S units, released firmware version 1.4.1 on March 6 to fix the flaw and others, with an update for Ledger Blue devices still pending.
What's compelling: Ledger's CTO had publicly said its security model was robust enough to buy from third-party sellers like Amazon and eBay, and its CSO said after the findings that he saw no reason to change that guidance - even though a reseller could pre-load code that drains a buyer's account on first use.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026