This week, self-custody hardware wallet company Ledger, which we wrote about last week, released a new feature called Ledger Recover, which is an opt-in service for Ledger users. The feature is a key recovery service that helps users recover their funds if they lose access to their seed phrase or their Ledger device. It works by encrypting and splitting up your key phrase and then sending it to Ledger and two of its partners to be held securely onsite. Users are then able to get the seed phrase by confirming their identity with an official ID document. Shortly after the announcement, users started to raise concerns about the security of the new feature. Until this point, Ledger publicly stated that functionality like this was not possible due to Ledger’s Secure Element chip that stores private keys inside it. But Ledger Recover functions by sending a user’s private key from the device, which has caused some users to question whether their private keys have been more exposed than they thought all along. Quickly, Ledger’s official Twitter released a statement from its CTO, Charles Guillemet, explaining that the new feature does not compromise users’ security. He explained, “If you choose to subscribe, Ledger Recover encrypts a version of your private key and splits it into three fragments (using Shamir Secret Sharing) - all of this happens on the Secure Element chip, so your Secret Recovery Phrase is not at risk.”

Social References: