Ledger CTO urges AI bug hunter responsibility, warns against ‘attention farming’

Hardware wallet makers Ledger and Trezor called for more responsible disclosure of security vulnerabilities.

Guillemet urged researchers to report bugs privately and agree on a timeline for fixes before publishing details. He cited 90 days as a common default, with flexibility depending on the severity of the flaw and the work needed to fix it.

“Ninety days is a commitment on the vendor, not just on the researcher,” Jan Komárek, Trezor’s head of security, told Cointelegraph. 

“Researchers: come to us first, agree a timeline, then publish in full, and if we fail to ship a fix in that window, publish anyway,” he said.

Hardware wallet security has come under scrutiny after Coldcard thefts exceeded $100 million and a data breach at Trezor’s shipping provider exposed tens of thousands of customers’ personal information.