Millions of dollars in assets of Ledger users are frozen, who is responsible for problems with integrated applications?
Recently, some users broke the news on social media that using the built-in Swap service of the hardware wallet Ledger for exchange, the funds were frozen for no reason. This incident also aroused the attention and discussion of a large number of investors and users.
secondary title
Changelly user: $3 million was "stuck"
According to social media reports, an investor K was frozen about $3 million when using Changelly.
At the beginning of November this year, K, as a Ledger user, chose Changelly integrated by Ledger to perform the Swap operation out of trust in Ledger.
K tried to convert about 2.93 million USDT to USDC on Changelly. After his operation was completed, although the Changelly platform displayed "transaction successful", his USDC did not arrive.
After contacting customer service, the platform customer service asked him to perform KYC operations. Prior to this, the Ledger Live App did not prompt about this.
K cooperated with the platform to carry out relevant procedures and submitted a series of documents including bank bills and business contracts. However, after the tedious and complicated process, even though Changelly had received K's complete reply and information, it did not proceed to resolve the incident. K said that Changelly had repeatedly pestered the same issue, re-asking for an explanation of several transactions from the address in question.
Changelly continues to question user K and does not advance the processing of the exchange. Since November 11, about $3 million in Swap by K has been seized. Still outstanding. K's appeal is very simple, that is, to return the 3 million funds. K is currently preparing to call the police in Hong Kong.
On ratings site trustpilot, Changelly still gets about 15 percent of one-star reviews, despite a 4.6/5 rating. Going through their negative reviews, we found that their negative reviews are all for the same reason, namely "SCAM (scam)". Some users bluntly said, "This is a fraudulent website." We found that, like user K, K is far more than one user who is required to perform KYC after a large amount of Swap. Many users had the same experience, and then their funds were "stuck" in Changelly. The platform neither released their funds, nor accused users of illegal operations, but kept asking for information and procrastinating, and finally formed The fact that user funds were seized.
secondary title
Wyre user: $1.48 million lost and recovered
Check the Ledger official website, we can see that the product integrates multiple Swap service providers. Including Changelly, Paraswap and 1inch, Wyre. It's not just Changelly that "cards" user funds, Wyre has also had similar incidents. An investor with the pseudonym "Tudou" also revealed his personal experience on social media.
In early November, Tudou attempted to conduct a stablecoin swap worth approximately $1.48 million on the Ledger Live App.
In the small transaction test of the two transactions, there was no problem with Swap, and the account was received normally. After a large transaction of 1.48 million US dollars, Tudou paid its USDT, but did not receive USDC.
The funds ended up going to a personal wallet address that started with "0x912f." Tudou then contacted Wyre customer service and demanded a refund of the funds. However, in the operation process of Ledger Live, it did not get the id of its transaction in Wyre, and Wyre rejected his request because it could not confirm the id.
secondary title
Centralized Swap: Ledger "drainage" for it
In the case of these two companies, whether it is Changelly or Wyre, their Swap is a rather "wonderful" product form.
Taking Changelly as an example, after actual experience, Odaily found that its Swap service is different from the common DEX exchange.
In Changelly, the exchange is not completed through smart contracts, the liquidity does not need to be provided by LP currency pairs, and there is no AMM mechanism. Its exchange process is an extremely primitive "transfer-receipt" model. That is, the user performs a transfer to Changelly, and Changelly transfers back the underlying token for the user.
In Wyre's Swap service, the process is no different from Changelly. There is no doubt that this is an exchange service provided by a centralized institution, not so much a Swap as a CEX.
From the transfer screenshot of “Tudou” mentioned above, we can also see that the 1.48 million USDT operation he performed was a standard “transfer” rather than an on-chain interaction.
In this case, whether the user can receive the "return" after the exchange, no third party has the ability to provide guarantee or endorsement.It can be said that the success of "payment collection" depends in a sense on the "conscience" of the accepting party.This is a fully centralized Swap process, and the security of user assets depends on the credibility of the institution.
But when users trust Ledger, all this is different again.
After actually experiencing Ledger Live, I found that its "exchange" service is highly integrated within the app, both in terms of functions and UI, which are seamlessly integrated with Ledger's official services.More importantly, its "exchange" page does not indicate the source of the service, and users cannot know where the exchange service is provided.
If the user does not screen, or will be misled by the UI, mistakenly think that this service is officially provided by Ledger.
Looking at the wallet app, functions such as "flash exchange" have become the standard configuration of the wallet. The so-called flash exchange is deeply integrated with the wallet, which has a more obvious independent entrance in the product, a simpler operation process, and a more convenient exchange operation. Such services are often not provided directly by the wallet, but through integration of third-party providers.
And when "exchange" and "wallet" are deeply integrated, the wallet also provides an endorsement for the exchange service to a certain extent, and users naturally have more trust in it, which also reduces the awareness of prevention to a certain extent. Previously,TokenPocket flash exchange service provider was stolen, many users who have used the service have their assets stolen, and users have lost more than 23 million US dollars.
Back to this incident, Ledger uses security as the main advantage of the brand. There is no doubt that such incidents did not impact the security of its wallet functions, but does this mean that Ledger is completely exempt from responsibility in such incidents?
Today, when DeFi has long matured and on-chain transactions are extremely developed. Trading through smart contracts is already a common thing. "Centralized Swap" such as Changelly and Wyre, with their heterogeneous product forms, may not win in the open market competition. Without the integration and endorsement of Ledger, users may not use such platforms as the first choice for transactions.
"Dark Forest" is a widely circulated description of the order on the chain, and it also reminds users of the dangers and high risks of this world. But can the repeated occurrence of such incidents really be attributed to the user's security awareness? Should Ledger, which has assumed the function of "drainage", also shoulder security obligations?
Take the FTX event as an example. In the middle of this month, three FTX-related cases were consolidated. A class-action lawsuit filed by users against a series of FTX paid celebrity endorsers, including NFL player Tom Brady, comedian Larry David, tennis player Naomi Osaka and the NBA's Golden State Warriors, has been consolidated and a new judge has been assigned. Or out of trust in these stars, some people became FTX users. When an accident happened to FTX, these "ambassadors" and "spokesmen" also had to face judicial disputes brought about by "drainage" of FTX.
Opportunities and risks coexist in the decentralized world. Remember the original vision of crypto? "Protect your assets, no one can take away the cryptocurrency in your wallet." The establishment of a benign order does not require complicated codes and obscure concepts to ensure that every ordinary user can safely use encryption technology. It still requires the joint efforts of every participant in the industry.
