Ledger CTO: Coldcard Vulnerability Warns Hardware Wallet Security Needs to Adapt to the AI Era

According to Decrypt, according to Decrypt, Ledger's chief technology officer Charles Guillemet said that the Coldcard vulnerability revealed the weakness of random number generation of hardware wallets, and emphasized that AI is reshaping the cybersecurity attack and defense pattern. Guillemet notes that the security model for hardware wallets “lives and deaths depend on random numbers,” and this incident proved this in the most expensive way.

Ledger stated that its hardware wallet was unaffected because its mnemonic words were generated by a hardware random number generator within a certified security element, with no software fallback path, and a full 256-bit random number was generated each time. Guillemet believes that open source code is not equivalent to security if it is not fully reviewed. AI is enabling attackers to scan code and identify vulnerabilities at machine speed, and defense must advance at the same speed. This requires reliance on security design, hardware, and mathematics. Guillemet suggests that users should understand how random numbers are generated and whether they have been independently certified when choosing a hardware wallet.