Is Nano Ledger S still safe after the data breach?

[Bitcoin Guy]

Hi Crypto Enthusiasts,

Is Nano Ledger S still safe after the data breach?  My concern is that would the hacker be able to use the customers’ profile/email/phone number to impersonate them and somehow get access to the stored coins.

If you do use a Nano Ledger, please share your experience in using it. 
And are there any good sources of tutorials on how to set it up, use it, and maintain it?

Thank you in advance! 

[1714093036]

1714093036

[1714093036]

1714093036

[DdmrDdmr]

<…>

They’d need to access your device physically. The leaked data will though make you very much prone to phishing/smishing attacks, possibly to sim-swapping, and one can never discard something taken on to a physical level (but so can that happen for having such and such a vehicle, living in a certain neighbourhood, etc.).  

Most of these vectors would apply to any assets you have outside the scope of protection of the Ledger device, which are now open vectors created as a side effect, which one will need to be wary of to mitigate accordingly.

All necessary tutorials are on the Ledger site itself.

[xcaret]

I had a few dollars in btc left from cashing out in 2018, ( at a loss) they were in my Ledger nano s .

there may have been $15 bucks is all . I had not thought about them until this summer when BTC was mentioned  on the radio , and it was going up in value .

one day after hearing that, I decided to get my laptop out and see what my account held . I was just doing it out of curiosity as I knew it was less than $20 . well to my surprise I had something like $30 of btc . That's thirty Canadian dollars ,not 30 thousand ,so I once again put it out of my mind .

I did have a ATM receipt from when I'd bought $500 worth of btc shortly after selling what I had in 2018 .

Well along came this January ,and I hear the price is sky rocketing . I start looking to see how to cash out my btc's . As luck would have it I managed to sell my $500 atm paper wallet for $2,200 .

So I was soon watching btc go down hill ,and thinking when it hits bottom ( in my opinion) I'd buy it back.

My laptop I had Ledger live on had gotten destroyed so I downloaded Ledger live onto my old desk top pc and plugged my Ledger nano S in . It showed my accounts ,but zero balance . I thought Ledger wasn't working right .i

I had used my Ledger nano S twice in 2018 but that was all, so I'm not familiar with it.
I was sure I had a tiny few btc still in my ledger .

When I gave up trying to get the Ledger to show my account balance .( it showed zero balance),I downloaded Electrum ,at the advise of someone on this forum.
That was super easy , but Electrum showed zero balance too .

To end my long story .I know there was money in an account (btc),but where it went i don't know .

I live alone and know one had my seed or private key ,or password to my Ledger.

When Ledger live first showed my balance at zero , I tried to contact them, but they dont take phone calls. I went to their chat and Kattie a robot ,kept saying the same things over and over , I typed in "agent" which Kattie said to do if I wasn't getting help from her . I got a ticket number emailed to me , but that was a week ago ,and still no reply .

As part of my attempts to see why my Ledger wasn't responding (it was, but i didn't think it was ) I went on face book and typed in Ledger nano S .. hundreds of people complaining about no support loss of coins , all of them frustrated as can be.

My advise ,as a Ledger nano S owner is that you download Ledger Live  go to their support page and pretend you need assistance ,and see what happens . nothing will happen except Kattie will assure you help is only 24 or 48 hours away
 
As I mentioned , my Ledger nano S is working properly , but I thought  it was me who was screwing up when I saw zero balance.  But what if it was an amount more than the few $ I had ??

Actually I advise you to go to their support page and facebook  too , but try that with Electrum too . by the time i got around to giving up on Ledger and downloaded Electrum , I believed them both when Electrum showed no balance too.
Good luck with what ever you decide .     
   

[suzanne5223]

When I gave up trying to get the Ledger to show my account balance .( it showed zero balance),I downloaded Electrum ,at the advise of someone on this forum.
That was super easy , but Electrum showed zero balance too .

And electrum wallet is full sync? If yes, you should wallet transaction details which will show you when the coin was moved.

I live alone and know one had my seed or private key ,or password to my Ledger.

Living alone doesn't make less vulnerable to attack if you can avoid the basic human error and the last time I checked most Nano S user lost their coin through buying their wallet from an unofficial store, human error and chrome Ledger extensions. As said early the device needs to be accessed physically for it to get hack, if you truly lost your coin then someone has the private information to access the wallet.

[blockman]

Hi Crypto Enthusiasts,

Is Nano Ledger S still safe after the data breach?  My concern is that would the hacker be able to use the customers’ profile/email/phone number to impersonate them and somehow get access to the stored coins.

If you do use a Nano Ledger, please share your experience in using it. 
And are there any good sources of tutorials on how to set it up, use it, and maintain it?

Thank you in advance! 

You don't need that info to access your Ledger nano s. It's a different setting when you're accessing your hardware. Physical touch is needed because you need to confirm it through the hardware if you are trying to send funds to another person. As a Ledger nano s user, I'm safe and don't have to think about such hacks just because of the data breach. What's annoying is that you'll receive random emails from scammers that want you to log in your recovery phrases on the links they'll attach but you don't need any interaction with them, many times have I ignored those emails.

[bitmover]

Is Nano Ledger S still safe after the data breach?  My concern is that would the hacker be able to use the customers’ profile/email/phone number to impersonate them and somehow get access to the stored coins.

It is impossible, because your private keys are locally stored in your device. This devices never send any information online. Ledger do not have access to your coins.

The data breach was related to addresses, phone numbers, email addresses... a terrible privacy data leak, but not to worry about your coins.
I would still buy a ledger nano.

[Yaunfitda]

As others mentioned, what was leaked was your name and physical address and email address.

They can't used that info to access your private key, they have to physically have your devices to do that.

As a Nano user, yes, I got the phishing email, but I just ignore it, the problem is that there are Nano users who didn't check the email's authenticity first, that's why they become a victim.

[pixie85]

Your private keys aren't stored by Ledger, so there's nothing to worry about.

The data Ledger has was only from people who bought in their store and registered on their site. If you bought your device somewhere else your email wasn't leaked.

Even if you registered on their site the hacker has your email now, just like all other online stores do. It's a good idea to use one email for private stuff like your bank account and another for online purchases.

[Oilacris]

Is Nano Ledger S still safe after the data breach?  My concern is that would the hacker be able to use the customers’ profile/email/phone number to impersonate them and somehow get access to the stored coins.

It is impossible, because your private keys are locally stored in your device. This devices never send any information online. Ledger do not have access to your coins.

The data breach was related to addresses, phone numbers, email addresses... a terrible privacy data leak, but not to worry about your coins.
I would still buy a ledger nano.

Definitely right!

This had nothing to do or does affect Nano's security in talks into their hardware product. The leak or breach is only into those informations but doesnt
included nor necessary on opening someones wallet.Even Ledger itself doesnt have the access just like what been said.
So theres no need to worry on this matter.

same as others i do still trust up this HW.I dont see anything much better than on this one.

[xcaret]

Thanks suzanne5223 ,

By the time I  had finally gone to Electrum, I was exhausted from trying to understand what my ledger nano was showing ,my head was ringing.

I did sync Electrum, and I did see several strings of addresses ,I think they were showing zero balance, or "spent "   I forget now, but From what you said ,I think I'll go back and check .

What was in there was worth next to nothing , and I just got it in my head not to give up, trying to figure Ledger live out.
Little did I know several people on here already gave me all the instructions i needed .

I was convinced that I had more than zero balance ,that's why I kept trying different things .

I could even have been mistaken thinking I had a few dollars still in the ledger.

I'm getting that stressed felling just remembering it all .

Any way I'll drop it for a few days , and if BTC stays low I'll check with Electrum and use it from now on, instead of Ledger live .

What I said about Ledger's horrible lack of support , and even worse reviews on Facebook is still something a potential Ledger nano S should checkout first.

[Bitcoin Guy]

What I said about Ledger's horrible lack of support , and even worse reviews on Facebook is still something a potential Ledger nano S should checkout first.

I did contact them (even though I haven’t installed the Ledger yet) and they got back to me after two weeks with an email that began with this

“ Thanks for your request.

Your request for data information has been transferred to our internal privacy policy team. In accordance with our Privacy Policy and the European General Data Protection Regulation, our data protection team will evaluate your request and get back to you within due delays. In accordance with our Privacy Policy and the European General Data Protection Regulation, our data protection team will evaluate your request and get back to you within due delays (this can take up to 4 weeks to get a response).”

So altogether it may take up to 6 weeks - that is, if they get back to me.  

By the way, what is Electrum?  Does it work the same way as Ledger Live?

[Bitcoin Guy]

After reading your posts, I now understand that the private keys are stored in the ledger itself and the company does not store our private keys. 

In such case, how does the recovery function work if one is recovering the coins to a new ledger device by using the 24-word phrases and the user info?  How does Ledger Live able to transfer the private keys to the new device?  Is it being done using some type of encryption conversion?

[Darker45]

In such case, how does the recovery function work if one is recovering the coins to a new ledger device by using the 24-word phrases and the user info?  How does Ledger Live able to transfer the private keys to the new device?  Is it being done using some type of encryption conversion?

Your 24-word seed holds all the private keys of all the addresses of all cryptocurrencies which Ledger supports. That's everything that you need to recover everything you own. So once you input your 24-word seed to a new device for recovery, all the private keys will be restored there.

You need to take note that your private keys are not stored in the Ledger Live app. There is, therefore, no transfer that happens from your Ledger Live to a device.

[ranochigo]

In such case, how does the recovery function work if one is recovering the coins to a new ledger device by using the 24-word phrases and the user info?  How does Ledger Live able to transfer the private keys to the new device?  Is it being done using some type of encryption conversion?

Your Ledger device is used to store the seeds. Ledger uses BIP39, a mnemoric standards to convert your seed phrase into a long string of letters called the seed. The wallet uses the seed to derive the private keys using a child key derivation. Wallets do not store your Bitcoins.

Wallets are a way for you to make and sign transactions. They do not contain any Bitcoins. Transferring your seed phrase to another wallet or device merely means that you're transferring your seeds and thus your private keys into another wallet so you can make and sign transactions from there.

[Bitcoin Guy]

In such case, how does the recovery function work if one is recovering the coins to a new ledger device by using the 24-word phrases and the user info?  How does Ledger Live able to transfer the private keys to the new device?  Is it being done using some type of encryption conversion?

Your 24-word seed holds all the private keys of all the addresses of all cryptocurrencies which Ledger supports. That's everything that you need to recover everything you own. So once you input your 24-word seed to a new device for recovery, all the private keys will be restored there.

You need to take note that your private keys are not stored in the Ledger Live app. There is, therefore, no transfer that happens from your Ledger Live to a device.

So the private keys of all the supported 1000+(?) cryptocurrencies are all somehow embedded in these 24 words?  I would thought that the private key for a coin address is created after user install the coin app and deposited the coin.  I guess Im still a little confused on how private key works.  Isn’t a private key associated to a transaction after an exchange is made?  For example, if I haven’t transferred any BTC into the BTC account, would there be a private key associated to the account?  

Is the function of a coin (ex, BTC) app just to help user to see the specific coin info and to manage the coin?  
If I installed the EOS app and transferred 100 EOS coins to the ledger.  Later, I deleted the app to gain more space back, would the 100 EOS coins still be in my ledger wallet address?  If I reinstall it later on the same device, would I be able to see the 100 EOS coins?  The reason why I’m so concerned about this is because I got a Ledger Nano S which can only hold 3 of coin apps.  I need space for 7 other coins that I need to transfer.

Also, does Ledger Live store the information that my EOS account has 100 coins?  Else, if I use the 24-word phrase to recover my coins to a new ledger device, how would the 100 coins be there?  

I know this is a lot of questions, but please be patient with me.  

[Bitcoin Guy]

In such case, how does the recovery function work if one is recovering the coins to a new ledger device by using the 24-word phrases and the user info?  How does Ledger Live able to transfer the private keys to the new device?  Is it being done using some type of encryption conversion?

Your Ledger device is used to store the seeds. Ledger uses BIP39, a mnemoric standards to convert your seed phrase into a long string of letters called the seed. The wallet uses the seed to derive the private keys using a child key derivation. Wallets do not store your Bitcoins.

Wallets are a way for you to make and sign transactions. They do not contain any Bitcoins. Transferring your seed phrase to another wallet or device merely means that you're transferring your seeds and thus your private keys into another wallet so you can make and sign transactions from there.

Thank you for your answers, @ranochigo.  Are my understanding of the following correct?

Wallet = account?
The private keys are stored in the Ledger device? 
The private keys are updated when there are transactions occurred? 
One always need to connect the ledger to a computer in order to retrieve the coins ownership information?

[ranochigo]

Wallet = account?

Wallet is not an account. Wallets are just tools for you to spend Bitcoins.

The private keys are stored in the Ledger device? 

Yes.

The private keys are updated when there are transactions occurred? 

No. Your private key never changes.

One always need to connect the ledger to a computer in order to retrieve the coins ownership information?

No. You don't have to specifically connect Ledger to a computer. You can easily create a watch-only wallet by extracting the master public key, I think Ledger allows this and import it into a suitable wallet like Electrum. You only need to know the addresses which can be and will be generated by the seed stored inside your Ledger wallet.

[Lucius]

Is the function of a coin (ex, BTC) app just to help user to see the specific coin info and to manage the coin?  

What you need to understand is that the coin/s is always on the blockchain, you only have the information that allows you to control it via private key/s. When you install, say, a BTC app on your Ledger, and then add your BTC account to Ledger Live, you'll have a visual representation of what that account has (balance). Even when you just start Ledger Live without connecting Nano S, you will still see your BTC account and balance - you need BTC app and Nano S only for send coins.

If I installed the EOS app and transferred 100 EOS coins to the ledger.  Later, I deleted the app to gain more space back, would the 100 EOS coins still be in my ledger wallet address?  If I reinstall it later on the same device, would I be able to see the 100 EOS coins?  The reason why I’m so concerned about this is because I got a Ledger Nano S which can only hold 3 of coin apps.  I need space for 7 other coins that I need to transfer.

Deleting app/s does not mean in any case that you are wiping your coins, all your coin addresses are derived from a single seed, and as long as you control that seed, you control all his private keys, and you can't delete anything so to speak. Of course you will be able to see every coin you had in case you have to do a recovery.

Also, does Ledger Live store the information that my EOS account has 100 coins?  Else, if I use the 24-word phrase to recover my coins to a new ledger device, how would the 100 coins be there?

Ledger Live is not supporting EOS directly, therefore you will need a third party wallet - and you can see all the information on this link -> https://www.ledger.com/supported-crypto-assets

[Bitcoin Guy]

Ledger Live is not supporting EOS directly, therefore you will need a third party wallet - and you can see all the information on this link -> https://www.ledger.com/supported-crypto-assets

But I can still transfer EOS from other wallet into my account in Ledger, correct?  That is all I need for now.

@ranochigo and @Lucius
Based on the answers you guys provided, am I correct that
- The private keys allow user to extract information (like how many currently owned) from the blockchain and they do not change when when transactions occurred.
- When an transaction happened, the information is saved in the blockchain.
- Ledger Live is just an interface which user can use to see the coin information extracted from the private keys from the blockchains and to be able to manage the coins.
- As long as I have the seed to the private keys, these private keys (and therefore my coins) will not be changed when a specific app is removed.

Thank you all who participated in this thread.

[HCP]

Based on the answers you guys provided, am I correct that
- The private keys allow user to extract information (like how many currently owned) from the blockchain and they do not change when when transactions occurred.

You can technically do this with just public keys as well (that's how you create a "watching-only" wallet... it has the ability to "look" at the blockchain and find all the transaction history for the public keys that it holds.)

Public keys are derived from Private keys... but it's a one-way process... private key ---> public key... so if all you have is public keys, you can "look" but not "touch"

- When an transaction happened, the information is saved in the blockchain.

Correct... all information for all transactions is stored on the blockchain.

- Ledger Live is just an interface which user can use to see the coin information extracted from the private keys from the blockchains and to be able to manage the coins.

Effectively yes... all "wallet" applications are just interfaces for managing private keys, viewing transaction history and signing/broadcasting transactions.

- As long as I have the seed to the private keys, these private keys (and therefore my coins) will not be changed when a specific app is removed.

Sort of correct... Your Ledger holds the seed within it's secure element... from this seed, each coin app is able to to ask the secure element to derive it's particular set of private/public keys at will... if you remove a coin app on the device, nothing changes because the your seed is still stored in the secure element... and the transaction data is all contained on the blockchain... and you can't delete that!  

If you re-add the coin app... it's able to ask the secure element to derive exactly the same set of private/public keys... this is why the system is referred to as a "deterministic wallet"... as long as you have the same "seed" (which you can restore from your 24 words if required), you will always be able to generate the same set of private/public keys.

So, if you get another Ledger device (or any other BIP39 device or wallet application) and put the same 24 words in... it will regenerate the same seed... and therefore the same set of private/public keys.

This is the main reason why safely and securely backing up your 24 words is sooooooooo important! Those 24 words effectively allow full access to ALL your funds.