Oct 15, 2026 · 1h 19m
Ledger attack exposes the limits of hardware-wallet trust
Uneasy Money: Why Ledger's Supply Chain Became a Nearly $100M Target
The reported compromise shows that genuine hardware can still depend on vulnerable distribution channels, software, and human backup behavior.
- 1A legitimate reseller channel allegedly enabled hidden LTE hardware to target seed phrases without making devices obviously counterfeit.
- 2Panic after wallet scares can create fresh losses through phishing, fake apps, and rushed custody changes.
- 3The episode connects wallet security to broader questions about privacy tracing, bug-bounty incentives, and Starknet’s future architecture.
Don't miss
The hosts explain how a device can remain technically genuine while hidden hardware or the backup process exposes a user’s seed phrase.
The brief
Taylor Monahan and Austin Griffith examine a reported Ledger reseller compromise in which genuine devices allegedly carried hidden LTE hardware capable of intercepting seed phrases.
The deeper problem is trust: secure elements and authenticity checks cannot remove the moment when users display or back up a seed phrase.
The hosts warn that panic may be more dangerous than the original incident, as phishing, fake apps, and rushed custody changes have caused major losses.
The conversation widens to tracing through Zcash, an alleged OpenAI office bugging, DIY electronics, and an XRP infinite-mint bug bounty.
A final debate asks whether Starknet should become an L1, and whether AI agents will replace wallets and dApps while creating new security risks.
What was said on this episode
21 statements · 8 positive · 7 negative · 1 mixed · 5 neutral
The Ledger supply-chain operation stole nearly $100 million over roughly four to five months.
“we're talking about four months i guess five months maybe nearly 100 million dollars stolen”
Listen at 9:47
The compromised devices were genuine Ledgers that passed Ledger’s genuine check.
“it is a genuine Ledger. It's a real Ledger. And it passes the genuine test or the genuine check because it doesn't actually tamper with anything.”
Listen at 15:58
User-involved hardware wallets always expose a point where seed phrases become readable.
“there will always be some door if a user is involved so that they can physically write down the seed phrase”
Listen at 17:28
Recent reported Ledger losses mostly came from panicked users, not rogue LTE modems.
“the reports that we've been dealing with are not actually ledger drains due to rogue lt modems in the devices it's people who panicked and then did something terrifically stupid”
Listen at 19:18
AI will drive renewed interest in DIY hardware and Linux.
“with ai we're going to have a a whole blooming a whole renaissance of like people doing hardware people running linux things that normies didn't do before”
Listen at 21:04
iPhones are approaching practical security as hardware wallets.
“we're getting pretty dang close to having that be like an actual really secure thing that you can actually use”
Listen at 21:41
A new iPhone configured as a hardware wallet can be more secure than a Ledger.
“It can do that for you and it will be more secure.”
Listen at 23:31
Crypto’s high value makes hardware-wallet supply-chain attacks worthwhile.
“crypto has just simply gotten too valuable”
Listen at 24:09
Zcash remains sufficiently private unless users rapidly and poorly launder $100 million.
“zcash still sufficiently private unless you're laundering 100 million dollars incredibly rapidly and stupid”
Listen at 32:10
OpenAI and Anthropic hold exceptionally valuable intellectual property.
“It's hard to imagine a more valuable intellectual property cache than inside of OpenAI and Anthropic”
Listen at 40:18
A four-GB300 GLM cluster cost about $2.5 million and produces roughly 150 tokens per second.
“One guy, I think, bought four GB300s. It was like $2.5 million or something like that as a cluster. But he's getting like 150 tokens a second using GLM.”
Listen at 43:00
Many frontier AI models require roughly 800 GB to 1.6 TB of RAM.
“a lot of them are like 800 gigs or even now like 1.6 terabytes of RAM”
Listen at 44:02
Software development will soon become nearly real-time through AI assistance.
“soon like software will be almost real time where it's building the software for you as you're navigating through it”
Listen at 47:25
Google’s $250,000 bug bounty is near the top of its program.
“250k for reference is also like at the top end of like Google's bug bounty program”
Listen at 51:07
A bug bounty program should honor its published maximum payout for critical disclosures.
“if critical, the most critical disclosure is 250K, that's what it's always been. That's what you got.”
Listen at 52:11
Limitless bug bounties would eventually become unaffordable for companies.
“if you pay if your bug bounty is basically like limitless right or if it's scoped to like the cost that it's going to cost you right like to your market cap or whatever The long-term impact or like how bug bounties sort of pan out is that eventually like no companies can afford this shit”
Listen at 54:40
Ethereum will not need Layer 2 networks in the future.
“it's 2026 we have clankers ethereum is just not going to need l2s it just won't”
Listen at 1:08:04
Users will not need Layer 2 networks in 2027.
“no you won't need an l2 in in 2027”
Listen at 1:08:14
Layer 2s are well suited to sub-cent, sub-second consumer transactions.
“sub cent sub second transactions on l2s that makes so much sense for consumer facing apps”
Listen at 1:08:35
A technically ambitious Starknet L1 should not expect substantial user adoption.
“Don't expect anyone to use your network necessarily”
Listen at 1:09:27
AI will become the primary user interface for wallets and decentralized applications.
“ai is the new ui”
Listen at 1:15:37
Statements are attributed to the speaker as said on the episode and reflect their view at the time, not PodLume's. They are not advice.