Ledger and Trezor Advocate for Responsible Vulnerability Disclosure Practices

Hardware wallet manufacturers Ledger and Trezor are urging security researchers to adopt a more responsible approach to disclosing vulnerabilities. Charles Guillemet, Chief Technology Officer at Ledger, emphasized that advancements in artificial intelligence have made it easier to discover and exploit security flaws. He criticized the practice of disclosing vulnerabilities before a fix is available, describing it as "exploiting others' risks for attention."

Guillemet proposed that researchers should first report vulnerabilities privately and establish a timeline for fixes prior to public disclosure. He suggested a default period of 90 days for this process, although he acknowledged that this timeframe could be adjusted based on the severity of the vulnerability and the complexity of the required fix. Jan Komárek, Security Chief at Trezor, echoed this sentiment, stating that the 90-day period is a commitment to vendors rather than merely an obligation for researchers. He recommended that researchers initiate contact with vendors to agree on a timeline, with the option to disclose publicly if the vendor fails to implement a fix within the agreed timeframe.

This call for responsible disclosure comes in the wake of heightened scrutiny on hardware wallet security, particularly following significant incidents such as the Coldcard theft, which involved over $100 million, and a data breach at Trezor's logistics provider that compromised the personal information of tens of thousands of customers.

© 2026 KLEA News. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Source: KLEA News