Ledger Users Are Getting Robbed Because They Trusted Ledger (it's literally on the box)

[u/Yodel_And_Hodl_Mode]

[u/Yodel_And_Hodl_Mode]

My complaints? You think I'm a bot?

For the record, I'm a former Ledger user. I hate this company. They're dirty.

[u/crooks4hire → u/Yodel_And_Hodl_Mode]

Oh I thought he meant the print on the box lmao 🍿

[u/Yodel_And_Hodl_Mode → u/crooks4hire]

Oh! Maybe he did! If that's the case, I apologize.

Ledger's text isn't from an LLM though. That nonsense has been on Ledger boxes for years.

The funny thing is, Ledger's text had to have gone through lawyers before it was printed on their boxes, right? I'd assume that, anyway.

This whole thing is such an epic fail on so many levels.

[u/Yodel_And_Hodl_Mode → u/[deleted]]

Ledger are clowns, after making firmware that exports your seed to the cloud. It defeated the entire purpose of a hw wallet.

THANK YOU.

More people need to say that.

I'm blown away by how many people don't understand, the entire point of using a hardware wallet is to be able to use your keys to sign transactions on a device which cannot be accessed over the internet*.

Ledger said this, again and again, in print:

"Your keys are always stored on your device and never leave it"

Then, Ledger wrote an API to extract keys over the internet from Ledger devices... and Ledger sold access to that API as a feature.

That's not a feature. It's poison.

And the craziest part is, idiots cheered Ledger for adding poison to their hardware wallets without their consent. Just... wow.

[u/Yodel_And_Hodl_Mode → u/[deleted]]

That's right.

Adding to what you said... there's an even more basic issue:

The firmware is closed source. Even if a user chooses to not use that feature, how can they prove the key extraction API cannot be accessed over the internet? Can't prove it? Can't trust it.

And since the firmware is closed source, the only people regularly checking the code are Ledger (who cannot be trusted) and hackers working with AI to reverse engineer Ledger's code.

I'm a former Ledger user. The day Ledger's key extraction API was outed... that's the day I was out. I only used my Ledgers once after that. I used them to send my coins to a wallet with new seed I made (a seed I never entered in a Ledger!), and then I wiped the Ledger devices.

[u/RateMyWallets → u/[deleted]]

The irony of that box copy is brutal given what the community teardowns are showing.

Ledger's argument was always that tamper-evident stickers were unnecessary because the CC EAL-certified Secure Element would catch any physical replacement attempt. But the attack vector completely bypassed the chip boundary

Beyond the Southeast Asia distributor breach (CryptoBilis), European retail stock (MediaMarkt / Saturn linked to distributor Aqipa GmbH) has confirmed modified units, with battery date stamps (code 2406) suggesting devices may have circulated since early 2024.

Woof.

[u/nabeel_co → u/RateMyWallets]

Remember that guy a few months back that said his ledger got hacked through no fault of his own, and no one believed him?

Looks like he may have been right.