Hardware wallet manufacturers Ledger and Trezor have called for a more responsible approach to disclosing security vulnerabilities. In light of recent large-scale thefts exceeding $100 million and data breaches affecting tens of thousands of customers, the companies are emphasizing the need to discuss timelines before publishing information about discovered vulnerabilities. Ledger Chief Technology Officer Charles Guillemet noted that modern artificial intelligence technology has significantly simplified the process of discovering and exploiting software bugs. However, in the absence of proper regulation and accountability, some researchers rush to share information — something he describes as "attention-seeking at the expense of others' risks." The company is therefore urging researchers to report issues privately and discuss possible remediation timelines before going public.
According to Guillemet, the standard remediation period is typically 90 days, but may vary depending on the severity of the issue and the scope of work involved. Jan Komarek, Head of Security at Trezor, also voiced support for the initiative: "90 days is a commitment not only on the part of the researcher, but also on the part of the vendor." He added that the most important thing is collaboration with researchers in order to protect users and maintain trust within the community. Tensions around the topic of hardware wallet security are mounting against the backdrop of recent events, in which unique vulnerabilities led to significant losses and the exposure of customer data.
Transparency in matters of security and investigative ethics in the cryptocurrency space is of paramount importance. Companies engaged in hardware development must establish clear procedures for receiving vulnerability information and provide researchers with a safe channel through which to engage with them. This will help prevent potential risks to users and ensure safer use of digital assets. In an environment of rapid technological advancement, building strong relationships between manufacturers and researchers is a necessary step that can raise the overall level of protection across the cryptocurrency industry.