GridPlus opens source wallet firmware in Q3 amid Ledger debacle

Amid fallout from Ledger’s controversial decision to allow private keys to be “recovered” from its devices, cold storage competitor GridPlus has announced it will move to “open source” the firmware of its crypto wallets.

GridPlus took to Twitter on May 17 to inform its 17,500 followers that it will open source the firmware of all of its crypto devices in the third quarter of this year in an effort to increase transparency.

The most trusted name in cryptography, trusted by the world’s governments for decades for their most rigorous security practices, sold products through the CIA’s back door. How can we make sure this doesn’t happen again? Open source software.

GridPlus will open source its firmware in Q3. pic.twitter.com/889OnqXd20

— GridPlus (@gridplus) May 18, 2023

“This week’s hardware wallet discussions exposed trust assumptions that were taken for granted,” GridPlus wrote in a follow-up comment.

“We as an industry must hold ourselves to the highest standards and we are calling on all other hardware wallet manufacturers to open source their firmware as well for the benefit of our ecosystem.”

Much of the anger directed at Ledger over the past 48 hours stems from firmware — a term for software built into a hardware device — being updated that allows a user’s potential private key to be extracted from their cold storage device, despite reportedly assured users in the past the opposite.

Related: Ledger data leak: A ‘simple mistake’ exposed buyers of 270,000 crypto wallets

In particular, Ledger’s firmware is closed source, meaning that only the company’s own developers can review the code and inspect it for flaws. Open source code, on the other hand, allows any programmer to open and inspect pre-existing code to improve it and check for potential errors.

I speak directly to this point in a May 17 Q&A session on Twitter, Ledger Support clarified that it had “always been possible” for the company to write code that would enable key extraction and that users should rely on Ledger.

(1/2) Technically speaking, it is and has always been possible to write firmware that enables key extraction. You have always trusted Ledger not to implement such firmware, whether you knew about it or not.

— Ledger Support (@Ledger_Support) May 17, 2023

While Ledger’s announcement undermined many users’ understanding of the kind of privacy features its products offer, some have suggested that the outrage has been blown out of proportion.

Competitors seem quick to capitalize on Ledger’s ill-received announcement, with some opting to offer discounts on most of their products, including Trezor, Blockstream’s Jade, and BitBox.

Magazine: Ordinals Have Made Bitcoin a Worse Version of Ethereum — Can We Fix This?