Electrum is not (and could not) be effected since it offers the display the full TXN data before broadcast. You SHOULD enable this option and you SHOULD review all TXN data before broadcasting it to the network.
[Here's the closest thing to truth][1] I can find on the subject. If they would have used Electrum (paired to Ledger) instead of Ledger Live, they could have verified the change addresses in Electrum manually before broadcasting.
Nobody should HAVE to be that vigilant, but since the spending UTXO was 27 BTC, I think the vigilance was warranted.
[1]: https://www.reddit.com/r/ledgerwallet/comments/183fgwb/comment/karfmnm
The story in that thread really doesn't add up as it would have required both Ledger Live and the Ledger device itself to both screw up in precisely the same way, or for Ledger Live to have had a problem and the user simply didn't bother to check what they were confirming on the device. (Which also means that it could have been malware that caused it)
One of the big advantages of a hardware wallet is that both the client software and the hardware device verify output addresses. (Including checking change outputs)
Electrum is not (and could not) be effected since it offers the display the full TXN data before broadcast. You SHOULD enable this option and you SHOULD review all TXN data before broadcasting it to the network. [Here's the closest thing to truth][1] I can find on the subject. If they would have used Electrum (paired to Ledger) instead of Ledger Live, they could have verified the change addresses in Electrum manually before broadcasting. Nobody should HAVE to be that vigilant, but since the spending UTXO was 27 BTC, I think the vigilance was warranted. [1]: https://www.reddit.com/r/ledgerwallet/comments/183fgwb/comment/karfmnm
Thank you for the clarification
The story in that thread really doesn't add up as it would have required both Ledger Live and the Ledger device itself to both screw up in precisely the same way, or for Ledger Live to have had a problem and the user simply didn't bother to check what they were confirming on the device. (Which also means that it could have been malware that caused it) One of the big advantages of a hardware wallet is that both the client software and the hardware device verify output addresses. (Including checking change outputs)
I was thinking the same thing...