Ledger and Tzoror urge responsible AI bug disclosure, warn against attention farming

What happened

Ledger and Trezor, two major hardware‑wallet makers, asked security researchers to handle AI‑found vulnerabilities more responsibly. They warned that publishing details before a fix is ready can create “attention farming” that puts users at risk.

Key points

• AI tools make it easier to discover and exploit bugs in crypto wallets.
• Ledger CTO Charles Guillemet recommends a private disclosure window, typically 90 days, before public release.
• Trezor head of security Jan Komárek says the 90‑day period is a commitment from the vendor as well as the researcher.
• Recent incidents include Coldcard thefts over $100 million and a Trezor shipping‑provider data breach affecting tens of thousands of users.

Ledger CTO’s warning

Charles Guillemet posted on X that AI has lowered the barrier for finding and exploiting bugs. He said some researchers publish findings before a fix is available, a practice he called “attention farming with someone else’s risk.” He urged researchers to report bugs privately and agree on a timeline—often 90 days—for a fix before any public disclosure.

Trezor security view

Jan Komárek, Trezor’s head of security, echoed the 90‑day recommendation but emphasized that the deadline is a commitment from the vendor as well. He told Cointelegraph that researchers should first contact the company, set a timeline, and only publish after the vendor either releases a fix or fails to do so within the agreed window.

Confirmed facts

• Ledger’s CTO and Trezor’s head of security made the statements on September 8 2026.
• The 90‑day disclosure window is presented as a common default, with flexibility for severity.
• Recent security incidents involving hardware wallets have raised scrutiny.

Why it matters

Hardware wallets store private keys that control crypto assets. If a vulnerability is disclosed before a fix, attackers could exploit it and steal funds. Coordinated disclosure aims to protect users while still allowing researchers to receive credit for their work.

Sources

• Cointelegraph