Sending BTC with old Ledger Nano Firmware

[bitbitboo]

Still getting contradictory answers elsewhere so want to ask for expert opinions here. Please do not answer if you are certain about what you are saying.

I lost access to my 24-word seed. Bought new Ledger to send funds to but my old ledger with all my BTC has outdated firmware (version 1.5.5). Updating firmware risks resetting the Ledger and needing the seed (which I don't have).

Other than it might not work, is there any risk in trying to send BTC from my old Ledger Nano S (with the old firmware) to my new device? (e.g risk of the funds getting lost/disappearing? Risk of weak security causing them to be stolen some how? etc). FYI: my Ledger has the Bitcoin app version 1.3.13

Thank you for your knowledge!

[o_e_l_e_o]

Other than it might not work, is there any risk in trying to send BTC from my old Ledger Nano S (with the old firmware) to my new device? (e.g risk of the funds getting lost/disappearing? Risk of weak security causing them to be stolen some how? etc). FYI: my Ledger has the Bitcoin app version 1.3.13

As long as you don't accidentally try to update it in the process, then there is no additional risk I can think of beyond the transaction not working.

If I were you, I would just use Electrum to make this transaction. Doing so is very straightforward and bypasses all issues with the Ledger Firmware being out of date. Simply download and verify Electrum using links 1 and 2 at the bottom of this post, follow the instructions in link 3 to link your hardware wallet to Electrum, and then make the transaction. Once that's done, you can go back to Ledger Live to try to update your firwmare.

1 - https://electrum.org/#download
2 - https://bitcoinelectrum.com/how-to-verify-your-electrum-download/
3 - https://support.ledger.com/hc/en-us/articles/115005161925-Set-up-and-use-Electrum

[AB de Royse777]

Warning: Please handle the old device carefully since you do not have the seed.

This is what happen to me on the other day, but I do not suggest you to do that. I had my seed.

I was able to update my firmware using ledger live and at some point it was saying to have my seed with me, but it never asked for the seed. Again please do not try this because you do not have the seed.

Can you create a transaction with your old device without updating the firmware? If you can then create a transaction and send all the coins to the new device.

[bitbitboo]

Thank you for the answers.

Is it certain that if I follow those instructions with Electrum, I can just send with my old firmware and no possibility of the device updating the firmware?

[Lucius]

Firmware 1.5.5 is not so old to create any problems during upgrade to the latest firmware, but of course there is always the risk that the device will reset during this process, so it is better to play it safe and send everything to the new device.

Risk of weak security causing them to be stolen some how? etc). FYI: my Ledger has the Bitcoin app version 1.3.13

In terms of security, there is no doubt that firmware 1.6.0 and 1.6.1 brings some improvements in this regard, but no critical vulnerabilities are known that would at least remotely affect the security of the device itself. More information can be found here : Ledger Nano S firmware release notes.

As for the Bitcoin app, it would be advisable to have the latest version - although I'm not 100% whether you can install it on version 1.5.5 or it would require the latest firmware.

I can just send with my old firmware and no possibility of the device updating the firmware?

If you think the device will automatically upgrade to new firmware when you connect it to your computer, this will not happen - it is not an automatic process and requires manual approval via Ledger Live.

[bitbitboo]

Firmware 1.5.5 is not so old to create any problems during upgrade to the latest firmware, but of course there is always the risk that the device will reset during this process, so it is better to play it safe and send everything to the new device.

Risk of weak security causing them to be stolen some how? etc). FYI: my Ledger has the Bitcoin app version 1.3.13

In terms of security, there is no doubt that firmware 1.6.0 and 1.6.1 brings some improvements in this regard, but no critical vulnerabilities are known that would at least remotely affect the security of the device itself. More information can be found here : Ledger Nano S firmware release notes.

As for the Bitcoin app, it would be advisable to have the latest version - although I'm not 100% whether you can install it on version 1.5.5 or it would require the latest firmware.

I can just send with my old firmware and no possibility of the device updating the firmware?

If you think the device will automatically upgrade to new firmware when you connect it to your computer, this will not happen - it is not an automatic process and requires manual approval via Ledger Live.

Thank you! That is super clear!!

Just one thing. Someone I was communicating with earlier, who seemed knowledgeable, said "a vulnerability that could allow a compromized wallet app or malevolent wallet app to steal your crypto, but ONLY in the case you make a small transfer, since it would hijack the "change" address that receives the "change" from the Tx."

Is there anyway that could be true or is it definitively wrong?

[AB de Royse777]

Just one thing. Someone I was communicating with earlier, who seemed knowledgeable, said "a vulnerability that could allow a compromized wallet app or malevolent wallet app to steal your crypto, but ONLY in the case you make a small transfer, since it would hijack the "change" address that receives the "change" from the Tx."

Is there anyway that could be true or is it definitively wrong?

Just ensure that you have downloaded Electrum from their official site. I have given some information in this post you can use it.

The genuine version will be here always: https://electrum.org/#download
But still make sure you verify the downloaded Electrum exe file: https://bitcoinelectrum.com/how-to-verify-your-electrum-download/

And at the time of broadcasting a tx Ledger will ask you to check the address and approve it from ledger, so you are safe when using the hardware device with Electrum.

[bitbitboo]

Just one thing. Someone I was communicating with earlier, who seemed knowledgeable, said "a vulnerability that could allow a compromized wallet app or malevolent wallet app to steal your crypto, but ONLY in the case you make a small transfer, since it would hijack the "change" address that receives the "change" from the Tx."

Is there anyway that could be true or is it definitively wrong?

Just ensure that you have downloaded Electrum from their official site. I have given some information in this post you can use it.

The genuine version will be here always: https://electrum.org/#download
But still make sure you verify the downloaded Electrum exe file: https://bitcoinelectrum.com/how-to-verify-your-electrum-download/

And at the time of broadcasting a tx Ledger will ask you to check the address and approve it from ledger, so you are safe when using the hardware device with Electrum.

I was asking about the method Lucius recommended. Why the need to use Electrum if the Ledger Live method is equally safe?

[AB de Royse777]

I was asking about the method Lucius recommended. Why the need to use Electrum if the Ledger Live method is equally safe?

You will not need Electrum if you can send the coins from Ledger live however the reason for Lucius to suggest Electrum is that it may not ask for firmware update.

Still my question stands, are you able to broadcast the transaction? If you are then you need to send the coins to the new device as early as possible. Keeping your coins in the device which seeds are not with you is not safe.

[bitbitboo]

I was asking about the method Lucius recommended. Why the need to use Electrum if the Ledger Live method is equally safe?

You will not need Electrum if you can send the coins from Ledger live however the reason for Lucius to suggest Electrum is that it may not ask for firmware update.

Still my question stands, are you able to broadcast the transaction? If you are then you need to send the coins to the new device as early as possible. Keeping your coins in the device which seeds are not with you is not safe.

Yeah, it's allowing me to make a transaction from Ledger Live. I just want to be sure that this is safe before doing it. I was concerned by the statement I quoted ("a vulnerability that could allow a compromized wallet app or malevolent wallet app to steal your crypto, but ONLY in the case you make a small transfer, since it would hijack the "change" address that receives the "change" from the Tx.").  Is that worry reasonable or is that kind of vulnerability none-existent?

Thank you for the advice about the seed and safety.

[AB de Royse777]

Yeah, it's allowing me to make a transaction from Ledger Live. I just want to be sure that this is safe before doing it. I was concerned by the statement I quoted ("a vulnerability that could allow a compromized wallet app or malevolent wallet app to steal your crypto, but ONLY in the case you make a small transfer, since it would hijack the "change" address that receives the "change" from the Tx.").  Is that worry reasonable or is that kind of vulnerability none-existent?

Thank you for the advice about the seed and safety.

Do not worry about compromised or vulnerability for a few minutes.

If you can send the tx then your ledger must be asking to approve the tx? Before approving the tx check few things.

1. In the ledger live you have the correct output address
2. In the ledger device the display is showing the same output address.
3. Check both address with your receiving address again to see both matches.

If you check the result is always correct then approve the tx. You are safe.

Besides, you are going to send all the coins that you have in your old device so there will be no change address.

[bitbitboo]

Yeah, it's allowing me to make a transaction from Ledger Live. I just want to be sure that this is safe before doing it. I was concerned by the statement I quoted ("a vulnerability that could allow a compromized wallet app or malevolent wallet app to steal your crypto, but ONLY in the case you make a small transfer, since it would hijack the "change" address that receives the "change" from the Tx.").  Is that worry reasonable or is that kind of vulnerability none-existent?

Thank you for the advice about the seed and safety.

Do not worry about compromised or vulnerability for a few minutes.

If you can send the tx then your ledger must be asking to approve the tx? Before approving the tx check few things.

1. In the ledger live you have the correct output address
2. In the ledger device the display is showing the same output address.
3. Check both address with your receiving address again to see both matches.

If you check result is always correct then approve the tx. You are safe.

OK, I've put aside that worry momentarily and yes, the answer to those 3 questions are all good

...but I'm still keen to understand the legitimacy of this vulnerability idea before I hit send

[o_e_l_e_o]

Is that worry reasonable or is that kind of vulnerability none-existent?

This vulnerability was fixed with Bitcoin app version 1.3.3. Since you are using 1.3.13, it is not an issue. It was also fixed from Ledger Firmware version 1.5.5, so again, not an issue for you. See here for more info: https://donjon.ledger.com/lsb/004/

Also, provided you download and verify Electrum from the links I provided you above, then you know it is not a malicious wallet so it would not take advantage of this vulnerability even if it could. If you are still concerned about this, then provided you send everything in your wallet to the new wallet and therefore leave no change, then such a vulnerability could not be exploited since there is no change to hijack.

[bitbitboo]

Is that worry reasonable or is that kind of vulnerability none-existent?

This vulnerability was fixed with Bitcoin app version 1.3.3. Since you are using 1.3.13, it is not an issue. It was also fixed from Ledger Firmware version 1.5.5, so again, not an issue for you. See here for more info: https://donjon.ledger.com/lsb/004/

Also, provided you download and verify Electrum from the links I provided you above, then you know it is not a malicious wallet so it would not take advantage of this vulnerability even if it could. If you are still concerned about this, then provided you send everything in your wallet to the new wallet and therefore leave no change, then such a vulnerability could not be exploited since there is no change to hijack.

Thank you. And apologies to all for continually picking on each tiny detail >< Just, ya know, wanna be certain I'm safe here and paranoid that I'll mess something up with my non-techieness, especially trying to use a tool I haven't used before, like Electrum

[o_e_l_e_o]

Thank you. And apologies to all for continually picking on each tiny detail >< Just, ya know, wanna be certain I'm safe here and paranoid that I'll mess something up with my non-techieness, especially trying to use a tool I haven't used before, like Electrum

Not at all. Always far better to take your time and be sure of you what you are doing than to rush things and make a potentially irreversible mistake.

If you are not comfortable using Electrum then it is reasonable to try to make the transaction via the platform you are familiar with - Ledger Live - first. Although much older versions of firmware will not work without updating, I think 1.5.5 might be recent enough that it will work, but I cannot confirm this. As we have established, provided you are as careful as you would usually be, double checking all your addresses and amounts, and double checking everything on the screen of the device, then there is no additional risk other than the transaction not working and your bitcoin not leaving your wallet. If that's the case, then you can follow the steps regarding Electrum which definitely will work.

[bitbitboo]

Thank you. And apologies to all for continually picking on each tiny detail >< Just, ya know, wanna be certain I'm safe here and paranoid that I'll mess something up with my non-techieness, especially trying to use a tool I haven't used before, like Electrum

Not at all. Always far better to take your time and be sure of you what you are doing than to rush things and make a potentially irreversible mistake.

If you are not comfortable using Electrum then it is reasonable to try to make the transaction via the platform you are familiar with - Ledger Live - first. Although much older versions of firmware will not work without updating, I think 1.5.5 might be recent enough that it will work, but I cannot confirm this. As we have established, provided you are as careful as you would usually be, double checking all your addresses and amounts, and double checking everything on the screen of the device, then there is no additional risk other than the transaction not working and your bitcoin not leaving your wallet. If that's the case, then you can follow the steps regarding Electrum which definitely will work.

I'm EXTREMELY grateful for the help of everyone who contributed here.

Also super interested in how you developed your knowledge bases and what motivates you to help people like me in this area.

[AB de Royse777]

Thank you. And apologies to all for continually picking on each tiny detail >< Just, ya know, wanna be certain I'm safe here and paranoid that I'll mess something up with my non-techieness, especially trying to use a tool I haven't used before, like Electrum

Not a problem. It's better to move slowly so that you do not make mistakes. Let us know if you were able to move the coins to your new device. And this time do not lose the seed and the pin. The seed is the key of all the assets you have in the Ledger device.

Also super interested in how you developed your knowledge bases and what motivates you to help people like me in this area.

Most of us want more bitcoin users in the space. Imagine people around you are adopted to bitcoin. We will be able to achieve true bitcoin ecosystem.

[bitbitboo]

Thank you. And apologies to all for continually picking on each tiny detail >< Just, ya know, wanna be certain I'm safe here and paranoid that I'll mess something up with my non-techieness, especially trying to use a tool I haven't used before, like Electrum

Not a problem. It's better to move slowly so that you do not make mistakes. Let us know if you were able to move the coins to your new device. And this time do not lose the seed and the pin. The seed is the key of all the assets you have in the Ledger device.

Also super interested in how you developed your knowledge bases and what motivates you to help people like me in this area.

Most of us want more bitcoin users in the space. Imagine people around you are adopted to bitcoin. We will be able to achieve true bitcoin ecosystem.

Thanks. I've decided to sleep on it so I can come at this thread fresh in the morning and carry out the transfer without human error (getting late here).

Right on! I've spent the last couple of days spending hours upgrading my knowledge around crypto security. The seed will not be lost again (nor ever typed into a device!)

[AB de Royse777]

Right on! I've spent the last couple of days spending hours upgrading my knowledge around crypto security. The seed will not be lost again (nor ever typed into a device!)

Very important realization. Good luck.

[bob123]

Why the need to use Electrum if the Ledger Live method is equally safe?

He probably mentioned electrum, because this way you'd bypass any risks of accidentally updating your firmware.
Ledger Live is used to either send transactions or update the firmware. You don't want to misclick. And therefore he recommended you electrum. You can't accidentally update the firmware with electrum.

I was concerned by the statement I quoted ("a vulnerability that could allow a compromized wallet app or malevolent wallet app to steal your crypto, but ONLY in the case you make a small transfer, since it would hijack the "change" address that receives the "change" from the Tx.").  Is that worry reasonable or is that kind of vulnerability none-existent?

Such a malware existed, but it can't steal your coins.
It used a change address with a weird derivation path, which would result in your coins being "lost" until you know which exact derivation path has been used. Afterwards the attacker would blackmail you with that information he has.