‘There Is No Backdoor,’ Ledger Says in Response to Recover Reactions

Ledger’s newest Nano X update allows users to subscribe to a recovery tool that encrypts the users’ seed phrase and sends it to different custodians to reconstruct the seed after going through ID verification. 

However, Ledger customers are less than pleased by the news. 

Mudit Gupta, Polygon Labs’ chief information security officer, warned users not to enable the feature, calling it a “horrendous idea.”

Though Gupta did not take issue with the breakup of the key — he praised it, stating that “I may or may not be doing that personally as well.”

Gupta’s concern stems from the ID verification and the key access given to the contacts who are chosen by a user to store key parts, as it could open a door for identity theft.

Gupta wasn’t the only person concerned about the update. 

In a video on Twitter, Ledger Chief Technology Officer Charles Guillemet said that “there is no backdoor for anyone, neither us, a provider or even a very gifted hacker to access it.”

“Back door would mean that we control all ledger devices and could run automated updates for example…That’s not the case. Will never be the case. Only you can use functions on your Ledger. No one else can enter your pin code and press those buttons,” CEO Pascal Gauthier also said.

The Recover feature is an opt-in subscription and is not enabled by default.

“Ledger Recover is an optional subscription for users who want a backup of their Secret Recovery Phrase. You don’t have to use it, and can continue managing your recovery phrase yourself if that’s why you bought a Ledger,” Ledger tweeted. 

“The device sends encrypted shards of your seed to different companies if you decide to use the service. You can of course still choose to [back it up] yourself,” Ledger’s co-founder said on Reddit.

Ledger claims that “self-custody remains and will always be at the core principle of Ledger.” 

Wired, in February, clarified that the three recovery custodians would be Ledger, Coincover – a crypto custody firm – and EscrowTech – a code escrow company.

The concern around Ledger’s update comes a few years after the company was targeted by a cyberattack in the summer of 2020 which led to personal information of 270,000 customers being leaked. 

In response to the announcement, some Twitter users suggested that Ledger make Ledger Recover a totally separate product. 

Ledger did not immediately respond to a request for comment.

---

Get the news in your inbox. Explore Blockworks newsletters:

• The Breakdown: Decoding crypto and the markets. Daily.
• 0xResearch: Alpha in your inbox. Think like an analyst.