My Ledger Nano S has been hacked

[Antonioz]

no problem at all, you have to open the manager app first in chrome (not the bitcoin app), delete the bitcoin app, then reinstall it, it should be all good

[SamMTL]

HI guys,

I've had the SAME EXACT PROBLEM. except the second output is not my entire bitcoins but a random amount. I tried sending different amounts and I would get a second request with a completely random different amount of btc. sometimes its 0.6 sometimes its 1.1 sometimes its less sometimes its more.

every time I refuse the transaction.

I tried sending BTG and LTC from my nano ledger S and no problem. only got one output request and worked fined.

Now my BTC are stuck in my nano ledger S and don't know what to do.

Have you guys resolved the problem? I think my laptop has been comprimised, but I'm very safe with this laptop and have good anti-virus anti-malware.

[SamMTL]

Followed the instructions of deleting the bitcoin 1.1.9 app and installing the 1.1.10 on my ledger. problem solved.

WHAT A SCARE.

Thank you for the support on this forum

[bob123]

I've had the SAME EXACT PROBLEM. except the second output is not my entire bitcoins but a random amount. I tried sending different amounts and I would get a second request with a completely random different amount of btc.

The second output most likely was the change. Since you were always trying to send different amounts, different 'addresses' has been chosen to send from.
Every of your transactions had a different change which had to be confirmed on the nano s (on an older version).
You might read this: https://en.bitcoin.it/wiki/Change

Now my BTC are stuck in my nano ledger S and don't know what to do.

They are never "stuck" in your nano s.
As long as you have stored your 24-word-seed backup, you can always recover your coins from it with any BIP39/44 compatible wallet.
Your ledger nano s is a hierarchical deterministic wallet (https://en.bitcoin.it/wiki/Deterministic_wallet).

[killat]

I just configured My Ledger Nano S yesterday and got the same issue.

And ... I made the following test:
 - I sent an amount of BTC to my Exchange account.
 - In Blockchain.info I saw at the same time 2 transactions + Surprise: Final Balance: 0
 - a few seconds until I turned back to Bitcoin Ledger Application my face turned white. I thought all my BTC were gone (when using one of the most secure option in the market: hardware wallet)
 - in the application the balance was correct, not zero.

Conclusion: (not sure if by design or not but) when sending BTC from your Ledger, you will have at the same time 2 transactions: 1 to the destination address, second to another address that is associated to your Ledger, also.

[bob123]

I just configured My Ledger Nano S yesterday and got the same issue.

Thats not an issue at all. Read the previous posts in this thread.

...
In Blockchain.info I saw at the same time 2 transactions + Surprise: Final Balance: 0
...
Conclusion: (not sure if by design or not but) when sending BTC from your Ledger, you will have at the same time 2 transactions: 1 to the destination address, second to another address that is associated to your Ledger, also.

I would suggest you read https://en.bitcoin.it/wiki/Transaction and https://en.bitcoin.it/wiki/Change.

When sending BTC you create 1 transaction which usually consists of 1 input and 2 outputs (1 input / 2 output is the case when: input > amount_to_send)
Your input will be 'converted' to 2 outputs. 1 output will be the amount you actually send and the second output will be your change.

[BitBite5]

Could actualy Ledger wallet be hacked or is this just maybe technical issue because of upgrade or similar?
So far I thought this is the safest wallet that exists. It must be some other explanation.

[bob123]

Could actualy Ledger wallet be hacked or is this just maybe technical issue because of upgrade or similar?

No wallet is 100 % safe from being hacked. You just can't achieve full security.
There hasn't been any incidents yet where a ledger wallet got 'hacked'. While there has been found a vulnerability in the trezor wallet, ledger has been safe all the time.
Its alright to assume trezor/ledger hardware wallets are one of the safest way of storing btc's.

So far I thought this is the safest wallet that exists. It must be some other explanation.

It is one of the safest wallet that exist.
The explanation is user not being able to understand whats happening.
That kind of verification of the change output is not necessary and had confused the non-techy people. Most people just don't know how transaction work (i.e. https://en.bitcoin.it/wiki/Change).

[HCP]

Could actualy Ledger wallet be hacked or is this just maybe technical issue because of upgrade or similar?
So far I thought this is the safest wallet that exists. It must be some other explanation.

Did you actually read ANY of this thread?

It has already been explained that it was just a technical issue, caused by Ledger implementing SegWit functionality to the wallets... Usually, the Ledger ONLY requests confirmation for the original output #1 (the coins you are sending)... it does not ask for confirmation for output #2 (your "change").

The original wallet release that implemented SegWit functionality had a small "bug" in it, that started asking for confirmations for BOTH outputs. This confused people and they immediately started questioning whether or not it was a "hack" or their coins were being stolen.

Ledger immediately released an update that fixed this bug... and all was good. Except for people who don't read properly!

[CryptoRobert]

Wow, I have been reading all this thread with growing anxiety since I have just transferred all my BTCs to the Nano Ledger. So it is confirmed that wilh the 1.1.10 version of the Bitcoin app the problem is completely solved? More Feedbacks from some of the people who experienced this problem?

[HCP]

I have not had "Output#2" issue since updating the Bitcoin App on the Ledger to the required version. Just update the app, you'll be fine.

[CryptoRobert]

I have not had "Output#2" issue since updating the Bitcoin App on the Ledger to the required version. Just update the app, you'll be fine.

How do I see which version of Bitcoin App I have? When I'm opening the app I see version 1.9.13, which seems a very different numbering compared to the 1.1.10 you are talking about. And if I'm opening the Ledger Manager I can see that the latest version available is 1.1.18 (again something different that the 1.1.10 you are talking about) but it doesn't tell me anything about the version which is on my device.

[HCP]

How do I see which version of Bitcoin App I have? When I'm opening the app I see version 1.9.13,

Version 1.9.13 is the version of the "Chrome" app (aka "Ledger Wallet Bitcoin") that you install to your browser... but it is the version of the actual Bitcoin "app" that you install to the Ledger device (via Ledger Manager) that needs to be updated.

... And if I'm opening the Ledger Manager I can see that the latest version available is 1.1.18 (again something different that the 1.1.10 you are talking about) but it doesn't tell me anything about the version which is on my device.

Yes, the latest available its 1.1.18... it has been updated a couple of times since they fixed the "Output#2" issue. Any version from 1.1.10 should fix the issue.

You don't need the Ledger Manager to check the version (and you can't actually check it using Ledger Manager)... You have to check it on the device itself. Simply connect the Ledger device, unlock it... then select the Bitcoin App:



then scroll down to "About" and select it:



And it will display the Version number:

[CryptoRobert]

How do I see which version of Bitcoin App I have? When I'm opening the app I see version 1.9.13,

Version 1.9.13 is the version of the "Chrome" app (aka "Ledger Wallet Bitcoin") that you install to your browser... but it is the version of the actual Bitcoin "app" that you install to the Ledger device (via Ledger Manager) that needs to be updated.

... And if I'm opening the Ledger Manager I can see that the latest version available is 1.1.18 (again something different that the 1.1.10 you are talking about) but it doesn't tell me anything about the version which is on my device.

Yes, the latest available its 1.1.18... it has been updated a couple of times since they fixed the "Output#2" issue. Any version from 1.1.10 should fix the issue.

You don't need the Ledger Manager to check the version (and you can't actually check it using Ledger Manager)... You have to check it on the device itself. Simply connect the Ledger device, unlock it... then select the Bitcoin App:

then scroll down to "About" and select it:

And it will display the Version number:

Thank you very much, I have followed your instructions and everything went fine. I have discovered I had a very old version, 1.1.05, and I have upgraded it. However, I had to uninstall THREE other wallets of other coins before the wallet considered to have enough space for the Bitcoin 1.1.18. That's worrying.
I also have noticed that my Ethereum wallet is far behind the latest version available in the store. Anyone knows which are the bugs of the old versions? Given the little space on the Ledger now I am afraid to delete the Ethereum wallet since I have no other wallet except Bitcoin to uninstall if it would tell me again it has no space...

[HCP]

I have Bitcoin, Bitcoin Cash, Ethereum and Litecoin all installed at the same time. You should generally be able to have 4 (sometimes 5) apps installed at any one time.

The Ledger will correctly recreate the wallet whenever you reinstall an app, so there is no danger uninstalling and reinstalling apps. You won't lose any coins. If you don't have available space, you can simply uninstall an app and reinstall the app you want/need. For instance, if I needed Bitcoin Gold, I could just uninstall Ethereum, install Bitcoin Gold. If I needed Ethereum again... I could just uninstall Bitcoin Gold and reinstall Ethereum... etc etc ad naseum

I would imagine it is a bit of a nuisance if you use multiple currencies ALL the time... but I only use 3-4, so it is fine for me.

[SandroBIT]

Also just had the same issue. Thanks to the posts here, I discarded the bitcoin wallet on the ledger (not the chrome wallet) and reinstalled it. Bam... it worked. Sent out funds without any issues. No #2 transaction. In my case, it was the #2 transaction was a large chunk of my balance but just a random number. Not the remaining balance going out to some strange address. Thank you all who posted answers here!

[CryptoRobert]

I have Bitcoin, Bitcoin Cash, Ethereum and Litecoin all installed at the same time. You should generally be able to have 4 (sometimes 5) apps installed at any one time.

The Ledger will correctly recreate the wallet whenever you reinstall an app, so there is no danger uninstalling and reinstalling apps. You won't lose any coins. If you don't have available space, you can simply uninstall an app and reinstall the app you want/need. For instance, if I needed Bitcoin Gold, I could just uninstall Ethereum, install Bitcoin Gold. If I needed Ethereum again... I could just uninstall Bitcoin Gold and reinstall Ethereum... etc etc ad naseum

I would imagine it is a bit of a nuisance if you use multiple currencies ALL the time... but I only use 3-4, so it is fine for me.

I don't mind the nuisance, I just was worried that I had to uninstall THREE apps before the ledger allowed me to reinstall ONE app (the Bitcoin app). Now I'm having only two apps installed, Bitcoin and Ethereum, and I'm asking myself what would happen if I'd like to update also the Ethereum app and after uninstalling it the Ledger would then again require me uninstall THREE apps - which now are not there again to be uninstalled any more. It is the proportion 3 to 1 which worries me. Why did I not have space to install ONE app after that I had uninstalled ONE app? And, even worse, after that I had uninstalled also a SECOND app? Why did I need to uninstall THREE apps to have again the space to install just ONE app? It doesn't make any sense to me.

[HCP]

Probably because the apps are all different sizes... I know the "FIDO U2F" app is HUGE compared to other apps... unfortunately, there is no way to tell how big an app is, or how much space you have left on the device. It might simply be that after you uninstalled one of the smaller apps, it was only just short of free space... ie:

Total space 100
BTCApp:  30
ETHApp 2: 5
Coin3App 3: 50
Coin4App 4: 5

You tried to install the new BTCApp which is 40... so you uninstalled BTCApp... free space = 30 (can't install size 40,  then uninstalled Coin4App... free space = 35 (still can't install size 40), then uninstalled Coin3App, suddenly free space = 85... you can install 40... and still have 45 space left!

Or it could simply be that apps need to be in "contiguous" space... so you can't split an app across multiple free slots and empty space needs to be next to each other? Maybe try and remove ALL the apps and reinstall the ones you want from most important to least important.

But, I honestly have no idea how the file system is setup... I can get 4 or 5 apps... and it's a matter of seconds to uninstall and reinstall an app if I need to change one.

[CryptoRobert]

Probably because the apps are all different sizes... I know the "FIDO U2F" app is HUGE compared to other apps... unfortunately, there is no way to tell how big an app is, or how much space you have left on the device. It might simply be that after you uninstalled one of the smaller apps, it was only just short of free space... ie:

Total space 100
BTCApp:  30
ETHApp 2: 5
Coin3App 3: 50
Coin4App 4: 5

You tried to install the new BTCApp which is 40... so you uninstalled BTCApp... free space = 30 (can't install size 40,  then uninstalled Coin4App... free space = 35 (still can't install size 40), then uninstalled Coin3App, suddenly free space = 85... you can install 40... and still have 45 space left!

Or it could simply be that apps need to be in "contiguous" space... so you can't split an app across multiple free slots and empty space needs to be next to each other? Maybe try and remove ALL the apps and reinstall the ones you want from most important to least important.

But, I honestly have no idea how the file system is setup... I can get 4 or 5 apps... and it's a matter of seconds to uninstall and reinstall an app if I need to change one.

Yes, your reasoning makes sense, at some point I will make some experiments to find out something more. I think I have deleted Neo, Stellar and Ripple to make spece for Bitcoin.