Uneasy Money: Why Ledger's Supply Chain Became a Nearly $100M Target

Taylor Monahan (0:00)

And you know what, if you're moving fast, you're trying to launder this money, you got $100 million to get through, okay?

Austin Griffith (0:05)

Chase Guide to Laundering Money, part one.

Taylor Monahan (0:08)

Let me tell ya. The gods will f*** you up every time, kids.

Kain Warwick (0:18)

Hey, everyone, I'm Kain Warwick and welcome to Uneasy Money because what happens on Chained never stays on Chained. Before we begin, here's a word from the sponsors that make this show possible.

SPEAKER_4 (0:28)

This episode is brought to you by Nexo, the premier digital assets wealth platform. Earn daily interest on your crypto or borrow funds, all through one platform trusted by more than 10 million clients. Find out more at nexo.com. Geo-Bestrictions, eligibility, and terms apply. Not listening to Bits and Bips yet, it's our weekly Crypto and Macro Market Show with Ram Allawalia, Austin Campbell, and Chris Berkins. Search Bits and Bips and subscribe.

Kain Warwick (0:59)

All right, hey guys, we are back. I'm here with my co-host, Taylor Monahan, Security Expert, and Austin Griffith, Builder Enablement at the Ethereum Foundation. Hey guys, it's been a fun week. I just got back from a token in Singapore, which was good.

Felt like early bullish vibes, like bad things were still happening, but like people were partying. So it's that little like dip as we come out of the bottom. Hopefully we'll see. All right, our first story this week is Ledger. Man, Ledger, like Ledger, Ledger, Ledger.

I get that. Look, I've been a Tracer maxi for a long time. And so, you know, I feel kind of contractually obligated to break these guys over the coals, but like you have to feel for them, right? Like, it's a little bit like running a DeFi protocol. You know, everything that you do is scrutinized. You have people that are attacking you constantly. Every possible vector or, you know, mistake that you make is like massively exploited. And some of those mistakes are unforced errors for sure, right? Like, you know, like their company, right?

Taylor Monahan (2:19)

And they're French. They're so French. They're French, French men.

Kain Warwick (2:23)

Like, I don't know, like, I mean, you know, so I think like the, yeah, so the background is like Ledger has probably been one of the most like problematic attacked entities in the space, right? And part of that is because, you know, your job as a hardware wallet, right, is to secure a lot of money.

Like that's kind of the purpose, right? You don't need a hardware wallet for your $50 shitter slinging account, right? You do need it if you're like the signer on the Uniswap fucking Multisig or whatever the hell you might be up to, right? Or like the Ethereum Foundation's, you know, eighth trove, right? Like you want that shit to be secured by hardware wallet. Ideally, you want the hardware wallet to be connected to a machine that's air gapped. Ideally, you want to be in like a clean room with a fucking Faraday cage or whatever the hell that you're doing. And yet here we are, right? So this week's ledger debacle, I guess, was that one of their resellers, and like correct me if I'm wrong, but like there was a period of time where you didn't buy hardware wallets from resellers.

Taylor Monahan (3:42)

Yes.

Kain Warwick (3:42)

Just wasn't done, right?

Taylor Monahan (3:43)

But also if you lived anywhere outside of basically the US or EU, you couldn't buy hardware wallet either, right? Like where did you get your chain?

Kain Warwick (3:53)

Like fucking fly to the country.

Taylor Monahan (3:56)

Yeah.

Kain Warwick (3:56)

You're securing millions of dollars, man. It's like a $2,000.

Taylor Monahan (4:00)

But ledger has to, it's a business, bro. They have to solve their shit.

I mean, it's painful. It is painful. I think one of the reasons why ledger keeps getting, there keep being situations with ledger, but also with Trezor. Like none of this is unique to just them. Partially, it's because they have built a successful business that is still alive after nearly a decade. For both ledger and Trezor, and I have mad respect for both of them for-

Kain Warwick (4:32)

And hardware is fucking hard, man. It's so hard.

Taylor Monahan (4:35)

I tell people, don't build a freaking software wallet. These motherfuckers out here.

Kain Warwick (4:41)

Revealing a hardware wallet. The funny thing is for me though as well is like hardware is the hardest thing you can do. Clankers can't even really help you that much at this point. They can do software stuff. The degree of difficulty of what these guys are doing is very high.