Ledger HW.1 Recovery

[nivye]

Hello everyone,

I'm Niv, a security researcher. I recently published a vulnerability in the Ledger HW.1 device, specifically a bypass of the security keycard mechanism — detailed here and acknowledged by Ledger: https://donjon.ledger.com/lsb/017/

I hope this isn't off-topic (mods, feel free to remove if it is), but I know some users may have lost access to their HW.1 wallets due to a missing keycard — essentially a second password required for access.

After researching the device, I've found a method to recover funds from Ledger HW.1 devices without the original security keycard — strictly for legitimate owners who have lost theirs.

If this is relevant to you or someone you know, feel free to reach out over a dm here. I’m happy to help.

Best,
Niv

[LoyceV]

It would add a lot to your credibility if you can somehow prove you are who you say you are. For instance by posting on Twitter using the account linked inside the article. The medium link in there doesn't work anymore ("the author deleted it").

[nivye]

Apologies! You're all welcome to message me on Twitter instead: https://x.com/invlpgtbl

[Forsyth Jones]

Just like the HW.1 and the Ledger Nano (not the Nano S or Nano S Plus), the wallet backup (seed phrase) was displayed on the host screen (connected computer), right?

Even with the security keycard, you could just use the wallet backup to restore in another software or hardware wallet.

[nivye]

Ah if the user has his seed phrase of course he does not need this recovery - it's only for cases you have the Ledger HW.1 device and the pincode but lost the security keycard.
In any case the ledger never gives away the seed phrase of course.

[nc50lc]

I hope this isn't off-topic, but I know some users may have lost access to their HW.1 wallets due to a missing keycard — essentially a second password required for access.

This might get better engagement with its intended audience if this is posted to "Hardware Wallets" board; link: /index.php?board=261.0
You can use the small "move topic" button below (lower-left) if you want to move it there.
Don't know if there are still active HW.1 users here though.

You may also post a separate topic in "Services" board with additional information about the pricing (even free services are ok) and other terms.
Just don't double post this same thread, it should be specifically written for the service that you're offering.

[Pmalek]

Is this a free service, aka information that you offer to people or is it paid? I haven't read the Donjon report btw.
Do you require physical access to the hardware device or can you do what you do remotely?
How many HW.1 devices have you tested with your method, and does it work on all of them or does the success rate depend on something?

[nivye]

This isn’t a free service — it’s success-based and dependent on the specific case and client.
Physical access is required, although remote handling is possible. I’ve tested this on several HW.1 devices I had access to, but as always, there are no guarantees of 100% success.

[dkbit98]

After researching the device, I've found a method to recover funds from Ledger HW.1 devices without the original security keycard — strictly for legitimate owners who have lost theirs.

This is what you get when you waste money on ledger crap devices
Expect to see something similar happening for ledger n0n0 S very soon, using secret methods, magical tricks and paid customer support services.

[Pmalek]

Expect to see something similar happening for ledger n0n0 S very soon, using secret methods, magical tricks and paid customer support services.

As you know, with the Ledger Nano S, you don't need to back up any security keycards. When the time comes that the Nano S won't work with any software anymore, all people need to do is recover their wallet from seeds and optional passphrase somewhere else. Those who don't keep backups of their seeds and keys are one step away from disaster anyway, regardless of which hardware wallets they use. Those who do, will regain control of their money quickly.