ZenGo discloses BigSpender vulnerabilities in major Bitcoin wallets
Blockchain researchers at Zengo expose vulnerability affecting major crypto wallets including Ledger Live, Edge, and BRD, enabling potential double-spend attacks.
On July 2, 2020, ZenGo discloses BigSpender vulnerabilities in major Bitcoin wallets. Blockchain researchers at Zengo expose vulnerability affecting major crypto wallets including Ledger Live, Edge, and BRD, enabling potential double-spend attacks.
The vulnerability allowed attackers to potentially double-spend funds or prevent victims from using their wallets by creating specially crafted RBF transactions. The BigSpender vulnerability demonstrated that even well-established, widely-used wallets from reputable companies could contain serious bugs that exposed users to attacks.
The affected wallets—Ledger Live from hardware wallet manufacturer Ledger, Edge from a long-running mobile wallet provider, and BRD from one of the earliest mobile Bitcoin wallets—collectively served hundreds of thousands or millions of users. The discovery highlighted the importance of security research and responsible disclosure in the cryptocurrency ecosystem, where software bugs could result in direct financial losses rather than just service disruptions.
Zengo's researchers had followed responsible disclosure practices, privately notifying the affected wallet providers about the vulnerability before going public, giving them time to develop and release fixes. Ledger and BRD had released code updates to patch the vulnerability and paid undisclosed bug bounties to Zengo, while Edge was undergoing a significant code refactoring to address the issue more comprehensively.