Why Ledger’s New Seed Phrase Recovery Update Is Dangerous?

Crypto hardware wallet Ledger has come under fire after its latest seed phrase recovery update. Why exactly is this update so dangerous?
By Jai Pratap
Updated January 30, 2024
Crypto Hack: Transak Hit By Data Breach, 57,000 Users Affected

The hardware wallet Ledger often cited as the most secure way to hold your crypto has come under fire after its latest update. Ledger revealed last night that it will give an option to its users to link their seed phrase to their identity card or passport.

The entire selling point of a crypto hardware wallet like Ledger is that the users themselves have to be responsible for their recovery seed phrase. No third party has access to your recovery seed phrase. However, with the new Ledger Recover update, the hardware crypto wallet is offering a subscription service that would allow you to store your recovery seed phrase in an encrypted way.

Advertisement
Advertisement

How will Ledger store your seed phrase?

Ledger Recover update promises to encrypt and divide your seed phrase into three pieces. After that you will give over your identity proof, a selfie recording, and then three different custodians will secure those shards for you. The three custodians will be Ledger, Coincover, and a third provider. Ledger clarified that this is an additional service and users are allowed to keep their recovery seed phrases with them as they were doing before. Many online privacy advocates called this update dangerous and started a stir on Twitter.

Advertisement
Advertisement

Why Ledger Recover update is dangerous?

In order to avail this seed recovery update service, a user will have to connect their identity to their Ledger account. This will give another KYC pain-point for data leaks, hacks, and government censorship or surveillance. Above all, a user is being put in a position where they will have to trust a third party with their crucial ID information and information on all their crypto holdings.

A database of this sort could also become vulnerable to hacks and leaks. Also, the sales of the crypto hardware wallet’s users would be extremely valuable. Any of the “authorized third parties” could also decide to leverage the data as an income stream at any moment.

Earlier in 2020, Ledger suffered a data leak exposing phone numbers and physical addresses of nearly 300,000 customers along with over a million email addresses.

From the technical point of view, the code for this entire process is closed-source and unverifiable. Ledger Live uses Ledger’s nodes for all wallet sync, revealing every detail of your cryptocurrency activity and making it trivial for Ledger to link this to your ID itself.

All the KYC data is collected by Onfido. The company also handles the KYC onboarding and keeps track of your device and current activity when you upload/verify identity. Not only you are trusting Ledger and other authorized parties, you’re also trusting Onfido with your crucial information. Is it a disaster waiting to happen?

Advertisement
Jai Pratap
Jai Pratap is a Crypto and Blockchain enthusiast with over three years of working experience with different major media houses. His current role at CoinGape includes creating high-impact web stories, cover breaking news, and write editorials. When not working, you'll find him reading Russian literature or watching some Swedish movie.
Why trust CoinGape: CoinGape has covered the cryptocurrency industry since 2017, aiming to provide informative insights to our readers. Our journalists and analysts bring years of experience in market analysis and blockchain technology to ensure factual accuracy and balanced reporting. By following our Editorial Policy, our writers verify every source, fact-check each story, rely on reputable sources, and attribute quotes and media correctly. We also follow a rigorous Review Methodology when evaluating exchanges and tools. From emerging blockchain projects and coin launches to industry events and technical developments, we cover all facets of the digital asset space with unwavering commitment to timely, relevant information.
Investment disclaimer: The content reflects the author’s personal views and current market conditions. Please conduct your own research before investing in cryptocurrencies, as neither the author nor the publication is responsible for any financial losses.
Ad Disclosure: This site may feature sponsored content and affiliate links. All advertisements are clearly labeled, and ad partners have no influence over our editorial content.