Hardware wallet makers Ledger and Trezor are calling on security researchers to follow responsible disclosure practices by reporting vulnerabilities privately before making details public. According to Cointelegraph, Ledger’s chief technology officer said artificial intelligence has lowered the barrier to finding bugs, but argued that publishing technical details before a patch is available amounts to "trading other people’s risk for attention." He cited 90 days as a common default remediation window, while adding that the timeline can be adjusted based on the severity of the flaw. Trezor’s head of security said that such a deadline also represents a commitment on the vendor’s side. The comments come as hardware wallet security remains under close scrutiny. The report noted that losses tied to the Coldcard theft case have exceeded $100 million, while a data breach involving a Trezor shipping service provider affected tens of thousands of customers.
Hardware wallet manufacturers Ledger and Trezor are urging security researchers to disclose vulnerabilities responsibly, asking them to report issues privately first and agree on a remediation timeline with the vendor.
Ledger’s chief technology officer said artificial intelligence is lowering the barrier to vulnerability discovery. He also said some researchers publish technical details before a patch is released, calling that "trading other people’s risk for attention."
He pointed to 90 days as a common default deadline for fixes, while saying the timeframe can be adjusted depending on the severity of a vulnerability. Trezor’s head of security said that the deadline is also a commitment vendors are expected to meet.
Hardware wallet security has drawn renewed scrutiny recently. According to the report, losses in the Coldcard theft case have exceeded $100 million, and a data breach at a Trezor shipping service provider affected tens of thousands of customers.
The report was attributed to Cointelegraph and published by Techub News.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
