On September 7, Charles Guillemet, the Chief Technology Officer of Ledger, published an open letter advocating for coordinated vulnerability disclosure to become an industry standard. This initiative has garnered support from Trezor, Foundation, AnchorWatch, SEAL, and other market participants.

📌 AI made finding bugs cheap, but it didn’t make responsible disclosure optional.

Finding and exploiting vulnerabilities has never been easier. A few hours of prompting now does what used to take a skilled researcher weeks. Unfortunately, defenders no longer enjoy the asymmetry…

— Charles Guillemet (@P3b7_) September 7, 2026

“AI has made vulnerability discovery cheap, but it hasn’t made responsible disclosure optional,” the post stated.

Guillemet outlined a four-step process for coordinated disclosure: the researcher confidentially reports the vulnerability to the company, the team reproduces and verifies the issue, and then agrees on a timeline for a fix with the author.

As a baseline, he proposed a 90-day timeframe, although this could vary based on the severity of the flaw and the complexity of the patch. During the fix period, both parties refrain from publishing technical details. After the update is released, full disclosure occurs, and the researcher typically receives a reward.

According to Guillemet, the rise of AI makes this process particularly crucial. The lowered entry barrier enables inexperienced individuals to find real bugs, but some of them immediately share their findings on social media.

“Security remains a cat-and-mouse game, but with many more cats, and the user suffers,” he emphasized.

He identified three problematic scenarios:

  • reproducing a previously fixed bug and presenting it as a current attack;
  • full disclosure of a vulnerability before a patch is available;
  • publishing teaser posts like “critical vulnerability found” while gradually revealing details for attention.

“Call it what it is: a chase for attention at the expense of others' risk,” the expert wrote.

He described this practice as particularly dangerous for the cryptocurrency sector, where erroneous transactions are typically irreversible.

Three Appeals to Users and Researchers

Guillemet's first appeal was directed at users, advising them to promptly install firmware and application updates. He noted that language models have shortened the time between a fix’s release and the emergence of tools to exploit the old vulnerability, making delays riskier.

The second appeal targets new researchers using AI to discover vulnerabilities. Guillemet urged them to submit verified findings through official vendor disclosure programs. When publicly sharing, he recommended specifying the severity of the issue, affected product versions, and whether a fix is available.

“This is not bureaucracy. This is the difference between enhancing ecosystem security and creating a threat to users for a few likes,” said Ledger’s CTO.

The third appeal was aimed at companies and security professionals. Guillemet suggested they publicly endorse coordinated disclosure, reward researchers adhering to its guidelines, and avoid distributing publications that prioritize reach over user safety.

Trezor's Response

In a comment to ForkLog, Trezor's Head of Security, Jan Komarek, emphasized that discovering new issues does not necessarily indicate a failure in security.

“Security is not a state that can be achieved and maintained. It’s a continuous cycle: researchers find issues, manufacturers fix them, users update software, and the system becomes more secure,” he explained.

Komarek pointed out that this process is disrupted when technical details are shared before a fix is available or when a previously resolved issue is presented as active.

In the cryptocurrency industry, the repercussions can extend beyond the vulnerability itself. Fraudsters may exploit the ensuing panic to engage in phishing, posing as support services and urging users to “transfer funds to a safe place.”

“The secondary damage often turns out to be more severe than the harm caused by the bug itself,” Komarek noted.

He also supported the 90-day benchmark, stating that it should be a commitment for both the researcher and the manufacturer. In his view, if a company fails to resolve an issue within the agreed timeframe, the researcher should be allowed to publish the technical details.

Trezor stands firmly behind responsible disclosure. By working together, we can keep raising the bar for security, protect users, and share what we learn to make the whole ecosystem stronger. https://t.co/3g1W98fERn

— Trezor (@Trezor) September 7, 2026

Komarek specifically linked the discussion to an incident involving the Bitcoin sidechain Liquid Network. On September 6, unknown individuals identifying as white hat hackers withdrew approximately 4,000 BTC valued at around $320 million from the Liquid federation's wallet.

According to the SideSwap team, the service received 4,000 L-BTC. The tokens were destroyed as part of the standard withdrawal procedure, after which the federation paid out 3,996 BTC.

SideSwap claimed that during a subsequent investigation, Blockstream’s specialists discovered a flaw in the Elements software that allowed for the creation of L-BTC without proper Bitcoin backing.

The participants in the incident stated they would return most of the funds after fixing the issue and updating the network nodes. Blockstream later sent them a signed message confirming the completion of the update and readiness to accept the assets back.

“This violates the principles of responsible disclosure,” Komarek commented.

The Dispute Over Error Disclosure

At the end of August, the topic of coordinated disclosure was already a point of contention concerning Ledger. On August 22, the AI security company TestMachine publicly described a vulnerability in Ledger's Ethereum application.

🚨Every Ledger running the Ethereum app is vulnerable to signature substitution

A malicious dApp with WebHID access could race an APDU during your transaction review and swap the tx being signed while the device still shows the original

Here's what you need to know: pic.twitter.com/uWk2KvqVwq

— TestMachine (@testmachine_ai) August 22, 2026

The following day, Guillemet asserted that the Ledger Donjon team had independently identified the problem and resolved it prior to TestMachine's publication. He stated that the researchers contacted the bug bounty program only after the patch was released and had not coordinated public disclosure with Ledger.

On August 27, the OneKey Anzen team replicated the attack in a lab on Ledger's Ethereum application version 1.22.1. Due to a race condition, the device could display one transaction while signing another under certain conditions.

According to Ledger’s bulletin, the Ethereum application version 1.22.2 with a fix was released on August 13. On August 21, the company also addressed this attack vector at the Ledger Secure SDK level.

It is worth noting that in August, hardware wallet manufacturers Trezor and Foundation warned users about phishing attacks in light of the incident involving Coldcard.