Mo

Head of Brand Development // Curator @Ledger | My views are my own. Banner by @agoriamusic

[College.xyz @college_xyz]

The @Ledger Agent Stack: Build & Show bounty is now live on https://t.co/0ET48jTLli!

> Build with Ledger's new open-source Agent Stack (DMK + Wallet CLI)
> $100 per qualifying submission.
> 5 random participants will win a Ledger device.

Find more details below 👇

[Ledger @Ledger]

We submitted 3 proposals to the @IntersectMBO Cardano 2026 Budget process, covering the work that keeps Cardano solid on Ledger devices:

– Cardano app maintenance
– Clear signing for Cardano's top dApps + Ledger button integration
– Full CIP-113 token standard support

100+ proposals are up for community review right now. If you're a DRep or part of the @Cardano community, we'd value your eyes on ours 👇

Drop your questions in the comments!

[Charles Guillemet @P3b7_]

🔒 What good security practices looks like in 2026: a short story about a laser, a chip, and a vendor that responded well.

The @DonjonLedger just published their evaluation of the @tropicsquare TROPIC01 chip, the secure chip designed by Tropic Square and used, among others, in the Trezor Safe 7. It's worth a read, not only for the technique, but for the process.

The attack, in plain words. A secure chip is the tamper-resistant chip that guards the secrets inside a hardware wallet. Before running any new firmware, its bootloader checks a cryptographic signature. That's the gate. Using laser fault injection, the Donjon fired a precisely-timed infrared pulse at the silicon, at the exact microsecond the chip was deciding "is this signature valid?". One well-placed glitch later, the chip happily accepts firmware that was never signed by the legitimate vendor. Enough to run arbitrary code.

👍Tropic Square's response was exemplary. They acknowledged the finding immediately, engaged in deep technical discussion, shipped mitigation samples, proactively dug further themselves, and aligned on a coordinated public disclosure. No defensiveness, no spin. Just engineers helping engineers make the product better. It was appreciated by the team, it's unfortunately not always the case.

Sincere thanks to Tropic Square for the collaboration and the standard they're setting, and a hat-tip to @DonjonLedger team for the research.

Full writeup: https://t.co/XI0me70eJY

[Ledger @Ledger]

you're not ready for this summer

👀

[Charles Guillemet @P3b7_]

🚨 Google Quantum result was just rediscovered and IMPROVED!

On March 31, 2026, Google Quantum AI published a paper showing that 256-bit ECDLP, the hard problem behind ECDSA and therefore behind Bitcoin, Ethereum, TLS, and most of the world's authentication, can be solved with fewer than 1,200 logical qubits and ~90M Toffoli gates. Under 20 minutes on ~500,000 physical qubits.

BUT, they didn't publish the circuits. They published a zero-knowledge proof that the circuits hit those numbers. The standard read at the time: clever responsible disclosure, elegant.

Two months later, that read needs an update. Two things happened, in opposite directions.

1. The ZKP wasn't a stylistic choice. Google was stopped from publishing.

What was speculation in April is no longer. Google did not choose to keep the circuits private. The U.S. government prevented publication. The blog post phrased it politely ("we engaged with the U.S. government"). Call it what it is: diplomatic cover for a publication block.

This is the line Scott Aaronson warned about. At some point, the people estimating the resources needed to break deployed cryptosystems would stop publishing. We just watched it happen, and the actor enforcing the silence isn't Google's PR team. It's a government.

2. The ZKP turned out to be a reward function. AI used it.

Here's the part that's almost funny.

A ZK proof that "this hidden circuit achieves these resource counts" is, when you flip it, a public verifier of any candidate circuit. Submit a circuit, get back: does it compute ECC point addition correctly, and at what cost. Pass/fail plus a number. That is exactly the shape of a reinforcement-learning reward function.

The ZKP was designed to hide the attack. What it actually published is the reward function for rediscovering it.

The research community wired the verifier into an automated AI-driven search loop. They reproduced Google's numbers. Then they improved them by 11.5%. Two months, from outside Google, no access to the circuits, using the very artifact Google released to keep them proprietary.

Both of these are true at once. Hiding the circuits worked: nobody outside Google has Google's exact circuits. And hiding the circuits did not slow the frontier; it changed who is doing the search, and arguably accelerated it, because the verifier industrialized the search loop.

Let's NOT PANIC!
Neither of these is a working CRQC. There is still no quantum computer that can run this circuit. The headline state of the world has not changed.

What has changed is the honesty of every public PQC timeline. Cryptography exists to create mathematical trust in the security of systems. Trust isn't broken when an attack runs. It is eroded when the foundation looks thinner than the public record suggests, and the public record is now demonstrably thinner than reality in two ways: by classification on one end, by AI-driven re-derivation on the other.

In security, the moment you start doubting the foundation is the moment you start rebuilding it. Not the moment you panic. The moment you plan.

This isn't a moment to rush. It's a moment to commit to a migration plan and execute against it, knowing the threat model is shaped by what governments are willing to classify, not by what researchers are allowed to publish.

Stay safe. Stay honest about your trust assumptions.

[Polymarket Sports @PolymarketSport]

Wemby out here training like a Navy Seal. The Knicks might be in trouble.

[Acervo Victor Wembanyama @acervo_wemby]

esse video precisa entrar para a história da nba

[Nike Basketball @nikebasketball]

Greetings, @NBA Finals.

[Mo @Mo_RELS]

👽👽👽

[San Antonio Spurs @spurs]

FINALS BOUND 🎉

@HEB | @Ledger

[paul @tetsuoarena]

we got AgenC agents signing through Ledger Flex over BLE.

natural language -> CLI rail -> Ledger app -> local signature, no broadcast

the agent can discover the Flex wallet, keep the BLE transport explicit, prepare marketplace registration previews, and run a local signing probe without touching wallet JSON or secrets.

t his is the direction I care about: agents operating with real hardware-wallet boundaries, not hot keys hidden behind automation.

[Ledger @Ledger]

gm.

are you secure?

[Ledger @Ledger]

started with some pizza, now we're here 😏

if there was ever a day to celebrate how far BTC has come, it's today.

What would you buy with it now?

[Ledger @Ledger]

To everyone who held $ZEC before it was obvious.

Ledger Wallet™ app sees you 🔐

[Charles Guillemet @P3b7_]

You just patched last month’s Nginx vulnerability that was actively exploited in the wild?

It’s already time for a fresh 0-day RCE.

The whole world is basically “pwned-by-default”, patching vulnerabilities before they’re exploited feels like a Sisyphean task... 🫠

[Mo @Mo_RELS]

@Ledger 💧🔐

[Ledger @Ledger]

hyperliquid.

(on Ledger Wallet 🤫)

[Ledger @Ledger]

POV: you just upgraded your classic Ledger Nano and got a Ledger Nano Gen5, it arrived and it's beautiful 🔒

[Charles Guillemet @P3b7_]

Clear Signing is going universal.
Since tackling blind signing with ERC-7730 in 2025, the mission has expanded. We’ve passed the governance torch to the Ethereum Foundation, adding cross-chain support, and taking Clear Signing from a @ledger feature into a shared industry standard. 🧵👇

[Nike Basketball @nikebasketball]

It's on sight.

[San Antonio Spurs @spurs]

H1M: 41 PTS, 24 REB, 3 BLK, 3 STL