Ariel Wengroff @AWengroff

👉For 4 years, 1 day, and 10 hours, anyone who understood the Orchard circuit could have minted ZEC out of thin air, silently, with no on-chain signature. The bug was disclosed this week. It was found by an AI-driven audit running Opus 4.8, not by an attacker. 1. Call the bug what it is Two lines in halo2's variable-base scalar multiplication gadget used assign_advice() where copy_advice() was required. As a result, the diversified-address integrity check pk_d = [ivk]·g_d could be satisfied for arbitrary inputs. A malicious prover could spend the same note multiple times with different nullifiers, i.e. counterfeit ZEC inside the Orchard pool, undetectable on-chain because the privacy of the ZK proof hides exactly the inputs that would reveal the attack. We do not know whether it was exploited. We will probably never know. 2. Four years. Multiple audits. Top-tier reviewers. Orchard was reviewed by some of the strongest cryptographers in the field before activation. They missed it. Earlier automated audits with Opus 4.7 missed it. Opus 4.8 catches it in roughly 1 in 4 runs when prompted generically. The bug is hard. And ZK inflation bugs are not new. Zcash itself shipped a counterfeiting vulnerability in Sprout (BCTV14) that survived years before being silently neutralized during Sapling. Similar soundness issues have appeared in circom, halo2, and rollup verifiers since. The pattern is consistent: when the protocol is private, exploitation is undetectable. You patch the bug and hope. 3. What Zcash did right This was a textbook decentralized incident response: ▶️Audit: a full AI-assisted soundness audit of halo2 + Orchard, scoped end-to-end. ▶️Discover: the agent flagged the missing constraint and worked out the algebra to turn it into an exploit. A working RPC-level PoC in ~6 hours, mostly waiting on tokens. ▶️Coordinate: a soft fork disabling Orchard, prepared and distributed without leaking the bug, activated 2 days and 15 hours after acknowledgement. Coordinating a soft fork across miners, exchanges, and nodes without disclosing why is genuinely hard. They did it. ▶️Disclose: timeline, code lines, math, open questions. No spin. Worth naming explicitly: Zcash's turnstile invariant caps the value that can ever leave a shielded pool by the value that entered it. Privacy and verifiability inside the same protocol. That is not an accident. That is good engineering, and it is what kept the worst case bounded. 4. The economics of security just changed AI does not change whether bugs like this exist. It changes the cost of finding them. I wrote about this x.com/P3b7_/status/2…: a missing constraint in a 4-year-old production ZK circuit used to require a top-tier cryptographer with months of context. It now requires a few tokens, an API key, and a well-framed prompt. The defender benefits. The attacker benefits more, they only need to find it once, and they never disclose. Orchard is the optimistic version of this story: defense got there first. The pessimistic version is the one we cannot rule out, because the chain is private by design. 5. The only real exit You do not patch your way out of this asymmetry. You raise the floor. Formal verification of consensus-critical circuits, every assign_advice audited by SAT solvers and AI for under-constraint, as the reporter himself recommends. Proof-grade engineering that used to be too expensive is now cheap enough to be mandatory. Hardware roots of trust, secure enclaves, certified secure elements, WYSIWYS. Cryptographic guarantees the user can actually verify, not promises a host can lie about. Continuous AI-assisted audit of every consensus-critical commit, re-run immediately on the release of any new frontier model. Zcash didn't just patch a bug. They demonstrated the new defensive playbook: AI-driven audits, decentralized coordination, radical transparency, verifiable invariants. That is the direction the rest of the industry needs to follow. And those who don't raise the bar for security will be rekt in this new world. Stay safe. Stay honest about your trust assumptions.

zooko🛡🦓🦓🦓 ⓩ @zooko

2 days ago

x.com/i/article/2062…

37 397 2K 2.7M 900

Ledger researchers find flaw in chip used by Trezor Safe 7; Trezor says user funds safe theblock.co/post/403492/le…

.@Ledger researchers discovered a way to bypass firmware signature verification in the TROPIC01 chip used in @Trezor Safe 7. Before you panic: Attack requires physical device access Expensive lab equipment needed Researchers could not access any user private data TROPIC01 is only one of three security layers on the device User funds remain safe. A hardware-level fix is already in development. This is responsible disclosure working as intended: vulnerability found, vendor notified, patch incoming before anyone gets hurt. Hackless.io

keyboard_arrow_left Previous keyboard_arrow_right Next

The @Ledger Agent Stack: Build & Show bounty is now live on college.xyz! > Build with Ledger's new open-source Agent Stack (DMK + Wallet CLI) > $100 per qualifying submission. > 5 random participants will win a Ledger device. Find more details below 👇

GAME ONE

🔒 What good security practices looks like in 2026: a short story about a laser, a chip, and a vendor that responded well. The @DonjonLedger just published their evaluation of the @tropicsquare TROPIC01 chip, the secure chip designed by Tropic Square and used, among others, in the Trezor Safe 7. It's worth a read, not only for the technique, but for the process. The attack, in plain words. A secure chip is the tamper-resistant chip that guards the secrets inside a hardware wallet. Before running any new firmware, its bootloader checks a cryptographic signature. That's the gate. Using laser fault injection, the Donjon fired a precisely-timed infrared pulse at the silicon, at the exact microsecond the chip was deciding "is this signature valid?". One well-placed glitch later, the chip happily accepts firmware that was never signed by the legitimate vendor. Enough to run arbitrary code. 👍Tropic Square's response was exemplary. They acknowledged the finding immediately, engaged in deep technical discussion, shipped mitigation samples, proactively dug further themselves, and aligned on a coordinated public disclosure. No defensiveness, no spin. Just engineers helping engineers make the product better. It was appreciated by the team, it's unfortunately not always the case. Sincere thanks to Tropic Square for the collaboration and the standard they're setting, and a hat-tip to @DonjonLedger team for the research. Full writeup: donjon.ledger.com/blog/tropic01-…

GSG!!!

Yahoo Sports @YahooSports

4 days ago

THE PREDICTION WE’VE ALL BEEN WAITING FOR 🔮 Air Corgi shares her pick to win the 2026 NBA Finals 🏀🏆

969 3K 31K 6.6M 3K

AYOOOOO

MoonPay 🟣 @moonpay

6 days ago

Ledger sponsored the Spurs and they immediately made the NBA Finals coincidence?

123 34 354 20K 4

🔥🔥🔥 to say we are proud is an understatement. this team. this moment. LFG @spurs ‼️‼️

San Antonio Spurs @spurs

6 days ago

FINALS BOUND 🎉 @HEB | @Ledger

911 15K 57K 1.2M 784

Wemby to Carter Bryant: “I’m proud of you” 🥹

Wemby literally OWNS Chet man. It's EMBARRASSING at this point lmaooo

BIG SPURS WIN!!!

we love the partnership and this reminder is always WILD ! we are proud to be with the most determined team in the league. GSG! @spurs @Ledger @_pgauthier

Moose @JoeyMoose

a week ago

It’s insane to me that the 20 million+ people watching NBA playoffs see the Ledger logo at all times. Pretty damn cool 👏

124 21 355 27K 7

pre game 3 moment w the @spurs — what a team 🙏🏼 very proud partners at @Ledger

⚡️ JUST IN: Ledger added support for ADI Chain’s $ADI token as the UAE-linked network expands its stablecoin and tokenized real-world asset ecosystem.

@JeffGSpursZone @elliot_co @Ledger hahaha don’t be starting rumors !!

@JeffGSpursZone @elliot_co always @JeffGSpursZone ‼️‼️‼️🫶

🔔Post-Quantum Signatures: NIST's Second Wave In August 2024, NIST finalized its first PQC standards: ML-KEM (key exchange), ML-DSA, and SLH-DSA (signatures). A third signature, Falcon (FN-DSA, FIPS 206), is still in draft. Last week, NIST announced the nine candidates advancing to Round 3 of a parallel competition aimed at additional signature schemes, explicitly chosen to fill the gaps left by the first wave. Each of the standardized signatures comes with sharp trade-offs. None of them is naturally suited to threshold signing, and all have signatures that are large compared to ECDSA's 64 bytes. ➡️ SLH-DSA (SPHINCS+, hash-based) The most conservative choice: its security rests only on the collision resistance of a hash function. The price is enormous signatures (7–50 KB !!!). It is the safest pick for very long-lived signatures (firmware, archival, some blockchains such as QRL). ➡️ML-DSA (Dilithium, lattice-based). Compact and fast, while elegant, is younger than hash-based assumptions. It is becoming the default for TLS, PKI, and most non-blockchain ecosystems (~2.4 KB signatures). ➡️Falcon (FN-DSA, lattice-based). The smallest of the three (~666 B at NIST-I), which is why Algorand and Solana selected it. Its drawback: signing relies on floating-point arithmetic, making error-prone and side-channel-resistant/ constant-time implementations notoriously hard. Its FIPS 206 standard is still in draft. 🔍Most blockchains are leaning towards customized shorter versions of SLH-DSA. NIST is organizing a second wave of standardization. The goal is twofold: shrink signature sizes and diversify the underlying mathematics so a single cryptanalysis breakthrough cannot break everything. The nine Round 3 finalists span five families: 🔸 Isogeny: SQIsign 🔸 Lattice: HAWK 🔸 MPC-in-the-Head: MQOM, SDitH 🔸 Multivariate: MAYO, QR-UOV, SNOVA, UOV 🔸 Symmetric-based: FAEST Notably, no code-based scheme survived. Both Round 2 candidates were eliminated: LESS and CROSS were dropped because of 2 attacks 👉 Two candidates worth watching ⏩ SQIsign produces the smallest known post-quantum signatures by a wide margin: from 148B to 292B (depending on the level of security), with sub-130-byte public keys. That is the only PQC signature scheme today that even approaches the bandwidth profile of ECDSA, extremely attractive for blockchains, certificates, and firmware. The catch: isogeny-based cryptography is still young, signing is mathematically intricate, and side-channel hardening is an active research area. ⏩HAWK is essentially "Falcon without the floating-point." It is a lattice hash-and-sign scheme producing 555 B signatures at NIST-I (smaller than Falcon's 666 B) and can be implemented purely with integer arithmetic, a major engineering win. NIST has said the Round 3 review will last roughly two years and that any multivariate winners are unlikely to be standardized without yet another round. Realistically, the earliest a new signature standard will land alongside ML-DSA and SLH-DSA is 2028. The urgency to migrate has grown sharply, yet the current standards still have significant drawbacks, and this last-minute selection round, while necessary, collides head-on with the migration timeline.

Last week @Ledger N3XT — our education program across college campuses — went to Cambridge. Honestly one of the most inspiring parts was just spending time with students who are thinking this deeply and rigorously about identity, ownership, AI, privacy, and the infrastructure being built underneath all of it. 800 years of academic history, two days of conversations about digital identity, consent, and trust. We started with a fireside chat and Q&A. The students came prepared. One Masters student asked whether Ledger is evolving from securing assets into infrastructure for human identity — and whether that future protects choice or concentrates control. Not a casual question. A CS student pushed on quantum risk, identity, and why hardware matters at all in an increasingly AI-native world. His point was essentially: if intelligence becomes abundant and synthetic agents become indistinguishable from humans online, software alone stops being enough. At some point you need a physical root of trust tied to consent, identity, and verification in the real world. Then he moved to privacy: send someone £2 for coffee on-chain and they can potentially see everything you own. Those questions earned him a Ledger device. Most of the room got close. Dinner at The Cambridge Union turned into conversations about decentralised infrastructure for interplanetary settlement, synthetic identity verification, and agentic systems. Less “future of tech” panel talk, more people actively trying to work through the implications. The next day we toured Trinity’s Great Hall, the Wren Library, Newton’s apple tree. What stayed with me wasn’t the history so much as the continuity of the questions. How people establish truth. Authority. Consent. Ownership. We met with professors and students and started laying groundwork for deeper collaboration. Cambridge has a habit of stress testing ideas until they either collapse or sharpen. That’s useful. We’ll be back. ledger.com/blog-ledger-n3…

it's perfect! 🤩 #PorVida | @Ledger | #ad

keyboard_arrow_left Previous keyboard_arrow_right Next