Ledger owner? Your cryptocurrency can be easily STOLEN

Ledger owners might want to be aware: your hardware cryptocurrency wallets can be EASILY HACKED.

@anthony256

Published Feb 6, 2018 7:41 PM CST
Updated Nov 3, 2020 12:52 PM CST

5 minutes & 5 seconds read time

There might be $500 billion wiped away from the total cryptocurrency market cap, but now news is breaking that Ledger hardware wallets aren't very safe at all.

Ledger owner? Your cryptocurrency can be easily STOLEN | TweakTown.com

Ledger has posted on their Twitter account reminding users that they should "always verify [their] receiv[ing] address" by checking the "monitor screen" at the bottom of the transaction request form.

DocDroid posted a vulnerability report a few days ago, stating that Ledger hardware wallets have a major flat that lets attackers infect your crypto wallet with malware, and then trick users to send crypto to the hackers. The report stated: "Ledger wallets generate the displayed receive address using JavaScript code running on the host machine. This means that a malware can simply replace the code responsible for generating the receive address with its own address, causing all future deposits to be sent to the attacker".

There's a major problem here is that Ledger's design is inherently flawed, as the hardware wallet requires new addresses to be generated constantly, which doesn't give owners an option to "verify the integrity of the receive address". This could lead some users to thinking that a hackers' receiving address is fine, and then transfer their crypto to them.

DocDroid's report continues, saying that all Ledger software is easily exploited and can be modified by simple unprivliged malware. This means that users can get into the system, without the requirement of administrative rights. Wow.

Ledger's wallets can't check for integrity in their current state, which means they have no anti-tampering protection from these holes. DocDroid goes for the throat, saying that Ledger wallets are so badly designed that pre-infected devices could hijack users' first-ever transaction, which is just awful.

But don't worry, because Ledger replied to the report where they said on Twitter that the issue "cannot be solved in the absolute". The company continued: "A malware can always change what you see on your computer screen. The only solution is prevention and building an UX to make the user check on its device. On device verification feature has been added [six] month ago already".