Ledger and Trezor's 90-Day Bug Request Is Really a Fight Over Trust

Ledger and Trezor, the two largest hardware wallet makers, are asking security researchers to hold their findings for up to 90 days before publishing. It is a request that sounds procedural, and it is anything but. For these two companies, the public claim "your keys are safe on our device" is not a marketing line; it is the product, and the fight over who controls that message is now the central economic problem in self-custody.

Ninety days of quiet

On September 7, Ledger's chief technology officer, Charles Guillemet, published an open letter proposing "coordinated vulnerability disclosure" as a standard industry practice. Under the model, a researcher reports a flaw privately, the company confirms it and agrees on a remediation timeline, and both sides stay quiet until a patch ships — with 90 days as the baseline window. Only then does full disclosure happen. Trezor's head of security, Jan Komarek, backed the initiative and added a fairness clause: if the vendor misses the agreed deadline, the researcher has the right to publish anyway. Foundation and AnchorWatch, two smaller bitcoin-focused players, also signed on. The template is familiar: security researchers have pointed out it mirrors Google's Project Zero disclosure deadline.

The letter is less a change in Ledger's own behavior than an attempt to make the industry adopt it. Ledger's bounty program has for years operated a formal 90-day coordinated-disclosure policy, pays researchers in bitcoin, and — in a telling detail — refuses AI-generated reports that lack meaningful human analysis. What Guillemet is really asking for is an industry-wide norm that the market leaders get to define.

The bug-hunting fallout

The push has an immediate cause, and it is instructive. In late August, an AI-focused security firm called TestMachine posted that "every Ledger running the Ethereum app" was vulnerable to a transaction-substitution attack. Guillemet responded that Ledger had discovered and fixed the issue itself before the post appeared; a rival firm, OneKey's Anzen team, said it reproduced the attack in the lab against an older software version, which Ledger rejected as testing against an outdated build. Guillemet described such premature publication as "chasing attention at someone else's risk."

This is not a niche squabble. It landed amid a stretch of self-custody security scares: an alleged white-hat drain of roughly 4,000 bitcoin (about $320 million) from Blockstream's Liquid sidechain, a breach tied to a Trezor shipping provider that grew to expose around 81,000 customers' contact details, and reported Coldcard thefts exceeding $100 million. For a category whose entire value proposition is trust, every headline is either reassurance or a reason for holders to panic-move funds — and scammers are quick to exploit the panic.

The economics under the security story

Strip the procedural language away and a structural change emerges. Guillemet's own framing — that AI has turned security into a cat-and-mouse game "with many more cats" — is exactly why a deadline matters. When finding a bug was slow and manual, researchers were a scarce, careful resource. AI has made finding and even exploiting flaws cheap and fast, which compresses the window between a disclosed vulnerability and a working exploit. That is what makes premature publication dangerous: the seller of safety is asked to defend a claim against a weapon that someone else can now build in days. The 90-day rule is designed to buy the vendor time to patch before that weapon exists.

But the rule is not neutral. It favors whoever can fix fastest. Ledger and Trezor run full-time security teams and generally ship within the window; a lone researcher who gets paid in reputation instead of salary is asked to hand value to the vendor first and trust the process. The model converts an attention economy — where a researcher's career is built on being first to shout — into a structured pipeline that large, well-staffed incumbents are best positioned to win. Komarek's release clause is the guardrail that keeps the deal honest, but it does not change who holds the stronger hand.

That matters because of what the safety claim is worth relative to the hardware. The entire hardware wallet business collects on the order of half a billion to three-quarters of a billion dollars a year — a rounding error next to the value of the coins people entrust to these devices. A wallet maker is paid once at the point of sale; it does not take a cut of the assets it secures. Its margins therefore rest almost entirely on the willingness to trust, and its ongoing costs now include a permanent, AI-driven security arms race. The moat is not the secure-element chip, which is commodity-sourced; it is the credibility of the safety story, the depth of an in-house security team, and the distribution that gets a fix onto millions of devices.

Neither company is publicly traded, so there is no ticker to watch here. What the request offers an investor is a sharper lens on the self-custody layer. Ledger and Trezor are using their operational strength to set the rules of the trust game, and they are probably partly sincere: coordinated disclosure genuinely does lower the phishing and panic that follow premature hype, and it protects users. The same move also happens to shield the two brands' most valuable asset from the fastest-growing threat to it. The durable question for anyone sizing up the layer is not which firm found which bug this week. It is whether any hardware maker can keep the "safe" claim credible at a price people will still pay once AI makes every flaw cheap to find — and the two companies that answer that question most cheaply are the ones writing the rules.