69. Is your crypto on your Ledger Safe? + Why Ledger Failed In Market Communication

You've got really nerdy people building really complicated nerd trying to explain the complicated nerdy to people and they have absolutely cooked it. They've destroyed the primary value proposition to chase a new market segment.

Welcome back to another episode of the Benneberg show with your favorite MBA in high school dropout talking everything crypto business and personal growth. Today we've got a crypto episode on. Is your crypto really safe on the hardware wallet after the back of Ledger and now see a new feature that caused complete uproar. So we thought we'd dive into it today and Burges is going to give us the ins and outs. But I thought I'd just start with the headline and that is around the new feature that Ledger announced last week called Ledger Recover, an opt in subscription based service for backing up users seed phrases. What happened after the announcement is that fear spread throughout the community over whether Ledger could access all of its customers seed phrases.

And did they have a back door to all of our private keys. So social media went bananas. Misinformation about the service quickly spread and so people even encouraging Ledger owners to withdraw all of their cryptocurrencies immediately. Ledger then had to come out and provide clarity to answer the community's questions. In which was an absolute disaster of a day in terms of corporate communication from Ledger. And Bergs is the the man on corporate communication. So he's going to get into that in a second. But really everything was tied back around the confusion of the mechanics of this new Ledger Recover feature of the Ledger wallets, where many existing owners feared that Ledger had been lying to us for a decade about its claim that it could not access customer seed phrases. So when I hand it over to Bergs as we dive a little bit into what on earth happened and why this was just a complete and utter disaster on all fronts from Ledger's perspective.

Mate. What a bunch of potatoes. Like I saw this and I was like, oh my God, you've cooked the company. What have you done? All right, let's frame this up. So Ledger are a very trusted crypto hardware wallet provider. They're one of the big two. There's Trezor and Ledger generally and there's all other fancier ones that no one uses unless you live in your mum's basement. So you generally have one of these two and hardware wallets are very secure. And from your hardware wallet you generate a thing called a seed phrase which is 12 or 24 words. You write it down on a piece of paper, you keep it safe and it's on your ledger. Fantastic. Ledger have now come out and said, hey, we're offering a service.

Where we can grab your seed phrase, we can do some magic woo woo to it, probably encrypt it, split it, and then send it away to three parties, ones in the uk, one's in France, one's in America. And at any point in time, we can verify your identity, send those encrypted parts back to you, and you can regenerate your seed phrase on any ledger. And everyone has just gone, holy shit. Because what they're doing is extracting your private key, sending it elsewhere. And the first thing is, okay, hang on. You have an ability to extract my private key. What the fuck? That's the first what the fuck moment. Because you don't want anyone to know that except yourself. Then you're sending away to these magical companies that could potentially be subpoenaed and they would have to hand over that data and people could access your crypto. Holy shit. And you only need two of three of these. Okay, you don't need all three parts. Holy shit. And then people are freaking out because they're like, hang on a minute, I have to actually update the firmware on my ledger. So this is not optional. This is going to be in there the whole time. And people are absolutely losing their minds. And ledgers had to do so much backpedaling, they've had to jump on so many different webinars to explain this. They even put out with ledger support. This is ledger support saying, technically speaking, it has always been possible to write firmware that facilitates key extraction. You have always trusted ledger not to deploy such firmware whether you knew it or not. Holy shit. So, okay, okay, NBA hat on. This is what's happening, Ben. You've got really nerdy people building really complicated nerdy shit, trying to explain the complicated nerdy shit to people. And they have absolutely cooked it. What. What they did was they've destroyed the primary value proposition to chase a new market segment. I completely agree. A market segment exists where I don't want to look after my key or I don't trust myself. I want a separate party to do it, and I want them to do it in this way that should be offered through software as an opt in thing, not built into your firmware and start questioning the validity of your software. That's the first problem. Like communicating that and not explaining it and having to install that firmware, even if you don't opt in, is still on your ledger and people do not feel safe at all. Now, I love this. Trezor came out their competitor, direct competitor, the same day. Our software has always been open source and verified. Not your keys, not your coins, we don't have access to your seed phrase. Buy a Trezor now, 15% off. And I guarantee you their sales would have gone through the absolute roof. Like, these guys have completely cooked it to the point where they're now. We had to put messaging out to our members because people were panicking. Then they were losing their minds. They're like, holy shit, is everything going to be lost? Is this an FTX moment? What is happening? And we had to put messaging out to them. And now Ledgers backpedal and said, okay, we're not going to release the firmware. We've listened to the market and it was just the biggest disaster I've ever seen. And it is going to take so long for them to undo that disaster and build back the trust with their customers.

It's like a crazy idea. It's just like, not only did it open up and everyone realized that they have a back door, but they confirmed it. And, and the way they explained it was like, oh, we wouldn't do that because it had hurt shareholder value. It's like, are you fucking kidding me? It had hurt your shareholder value. What if you stole everyone's money?

Oh, and then it is, it is so crazy. They're like, you've always trusted us. It's closed source. Why do you think we do it now? And I'm like, whoa, that's exactly what a scammer says. Like, first of all, don't talk like that. They've open sourced certain libraries they use, but not the entire firmware. Right? So you can't. Or not the entire software. So you can't go, you can't do a code review. You can't pay someone you trust or a company to do a code review for you or an expert that, you know, it is absolutely crazy. And then let's, let's go a step further. Let's say this magically deployed. They did come out later and say they don't recommend it. Holding more than $50,000 on your ledger. If you use this service, this service, you have to opt in, pay 10 bucks a month. And then this is how it works. Your identity becomes the key in your wallet. You have to somehow magically identify yourself to them. And just in the last few months, Ben, what has happened with AI Deep fakes, all that sort of shit. And Ledger has millions of customers, let's say only 10% take this up and they need to restore this. How good and efficient or like thorough are the KYC processes going to be to be able to do this? Like they have beyond cooked. Why did they not just make another device that says hey, this is the special ledger. Recover one. If you want it and you want this service and you're that market segment, go and buy everyone else.

You are unaffected because we're not the market segment. And.

Oh my goodness, like everything about it, it's just like it's just a disaster on all fronts. Do they not think this would happen? What a scammers absolute like pool of paradise as well if that actually got released. All of a sudden you've got a, you've got hundreds, if not, you know, thousands. And if you've got hundreds of thousands of customers where you can now go and try and identity attack to get access. What a disaster.

And members still have in their minds. Oh sorry, customers, not members of Ledgers. Where Pledger had a data leak and it had all of their customers email addresses from phone numbers. All the shit you have to enter when you get something sent to your house. First of all, as a security company, why the fuck are you keeping that more than a month? You need to turf that data after you've sent it to them, right? And they just keep their email address, turf all their like delivery details, everything. People are literally getting letters to their house, trying to scan them in physical mail because they seem legit and then emails to their email address is trying to phish them because Ledger had that security breach and and now they've gone and done this. You're like, oh my Lord. It's just so crazy. Absolutely unbelievable scenes.

It's crazy to think that there's really two main players too in the, in the, in the game, you know, like Ledger and Trezor. I mean there's other wallets but like.

You know, that's it. There are other wallets. Even like a Checkmate that has this crazy one that looks like an old school calculator that does Bitcoin only, you know, like super secret stuff. This is, these are the two that you would have if you want to have had the most compatibility across the most, you know, crypto instances and play around with a lot of stuff. This is just the one thing I think like a product like this is great and it needs to exist but don't put it in your existing product and make sure your communication to the market is better not this thing is happening. You need to be concerned now this kind of Brings us to like all of the trade offs here. Like you're trust, if you're ever trusting someone else, that's a challenge, right? And you need to think like recovery options, how do they access it? And the trade off may be no one can access it, but then I am fully responsible for the entire custody of this. So you need to understand what you're willing to trade off. Now, if you have a ledger, do not panic. Everything is okay, it's safe. They haven't released the firmware yet. It is absolutely fine if you have a ledger nano s, it doesn't even work on that firmware, on that device. So you don't have to worry at all. Now when they do release this, we'll need to see how they actually do it. But it is opt in. So you can still potentially update your ledger and then not opt in for that service and it will not be activated. That doesn't mean ledger can't access your key. As I've said, we've always been able to do this, so that is something you'll need to live with. And what I would do for my ledger is not update the firmware and just wait to see how things go because I know it's secure at the moment. I'm happy with the level that it is at and I will start to see what happens and people reviewing it and what the direction they take as a company.

And hey, if you. And this is where people go wrong, Ben. So a lot of people freak out and they're like, I've got a ledger. I've got all my funds on there. Oh shit, I have to get it off. They go and buy something like a treasure. And they're not used to moving funds. They're not used to setting up new things. They might set it up in a panic, might not write their seed down properly. They might not do their recovery process and they'll get fucked. And this is how they lose funds. That has happened to a lot of people I know. If you are considering doing this, fine, go buy a Trezor. Go be happy or do a software, whatever you want to do. Go be happy. Wait until the emotion dies off. Look online, we've got a lot on Collective Shift and other trusted people like Andreas Antonopoulos and go through a process. So go through with your Trezor, set it up, write down your seed phrase, wipe your Trezor. Go through the recovery process. Sorry, send like a dollar to that Trezor. Go through the. Wipe your Trezor, go through the recovery process and make sure you can retrieve that dollar. Once you've done it, you know the seed phrase you've written down is correct. You can access it, you can restore it, then you can start to transfer your funds. But please follow a strict process. Test it with a dollar, wipe it, make sure you've got it right. You want to make those checks because when you start sending big money, there's no Bitcoin or Ethereum management to call to reverse that transaction. That money is gone.

Yeah, take it easy and wait and be patient and don't FOMO like Berg said. And we've got some great research on our website. But Berg, I want to ask you what went on here in Ledger. Where's the head of communications? Where's the head? Hit a product going, guys, this is a bad idea. He is just driven by the idea of having some amazing subscription revenue so they can now raise a bigger round and, like, have another product and da, da, da, da, da. Like, what on earth.

I don't know their exact company structure, but let's imagine a company that has a board, some executives, and they want more revenue. So they've seen a market segment. They're like, yeah, people want this. They may have tested it with a few people just to see how it goes. And they go, oh, hey, we've got some validation. This is great. What they failed to do is understand their brand, promise what they deliver, and actually send it out to a wider group to test. The problem that that organizations have is a lot of the time they're in an echo chamber. They want to align with their board, with their executives. They want to execute on it. They, this is the first time I've seen this message publicly and it shouldn't be, hey, this is what we're doing is going to drop in some firmware. If you want to test it, test it with a smaller group saying, this is what we're thinking of doing, this is how we're thinking of modeling it, and then get the feedback from them, because you need feedback in a smaller contained cohort before you go ultra wide. Because as soon as you do it and there's backlash, it's damage control instantly. I can understand the business motivation, but the execution on this was incredibly poor. And a company like Ledger that's been around for a while should know a lot better.

I totally agree, totally agree. I mean, it's what we. Well, it's what you know, it's what you've learned in the product, right? You don't test with the beta members. You get feedback. You iterate. But you test with a small group of people before launching Live and I feel like they're just gone bang. And it's a massive.

Exactly. And it goes against their brand promise. Like, even some launches we've had, they might be great with beta testers and then alpha beta and we do a small, wider group and then we put it out there and people reject it. But that's okay because we'd never do a change so big that it would. We wouldn't be able to either undo it or modify it. This completely shakes confidence. Buying a ledger is built on confidence, trust, safety, security, and they've completely fucked all those values. So when you're delivering a message or a product, it needs to align with your company values and your brand promise. And they have cooked it.

Now, if you need help, luckily for you, we offer crypto strategy calls so you can actually head over for 15 minutes and booking a time with either me or one of our team, you can head over to collective shift IO forward slash strategy, and for 15 minutes we'll walk through where you're at in crypto. We'll walk through some of your security stuff. Answering your questions is generally help you up, help you get set up, or help you optimize where you're at at the moment. We've done over 140 calls now. The feedback's been phenomenal. We'll get you to where you are now, to where you want to go. You actually talk to a real human being. Imagine that you can talk to someone you actually trust in crypto. So you can head over to Collective Shift IO strategy. We'll help you with all of that. Berg, thank you so much for breaking that down. We'll drop the links of the tutorials below. If you want to set up a trezor or you need to set up your ledger, but if you've got a friend that's been panicking around Ledger, been panicking about this news story, we'd love for you to send this to them. It's the way we grow the podcast. And as always, thank you so much for listening and we'll see you on the next episode.

Thanks so much, champions. Stay safe.