Ledger

Is Ledger safe?

The chip is; how devices reach buyers, and how the company handles customer data, are the weak spots. A Ledger keeps your keys on a secure element chip that never connects to the internet, and every transaction has to be approved on its own screen. But in October 2026 devices sold through one of Ledger's authorised resellers in Southeast Asia carried a hidden implant that stole their recovery phrases. We score Ledger 78/100, a B, held back by a 2023 supply-chain attack on its software and two leaks of customer data. The 2026 implant attack is still under investigation and not in the score yet.

For savings kept on an exchange or in a hot walletHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary like MetaMask, a hardware walletHardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary is still a big step up, if you buy it from a source you trust and set it up yourself.

What happened in the Ledger Connect Kit attack?

On 14 December 2023 an attacker phished a former Ledger employee whose access to the npm package registry had not been revoked, and published malicious versions 1.1.5 to 1.1.7 of Ledger Connect Kit, a library many dApps load to talk to Ledger devices. The code swapped real transaction requests for drainerDrainerA malicious website or script that tricks a crypto user into signing a transaction or approval that lets attackers empty the wallet.More in the glossary requests. Ledger said assets were drained for under two hours in total, put losses at about $600,000 and promised to repay victims in full. We did not find a final confirmation that every claim was paid.

The CryptoBilis implant attack (October 2026)

On 9 October 2026 Ledger said it was investigating lost funds among buyers of CryptoBilis, a reseller on Ledger's own list for Indonesia, Malaysia and the Philippines, and asked it to stop selling. A day later it confirmed an unauthorised hardware implant in one victim's device.

According to Ledger's security lab, the Donjon, the implant sits inside the case and reads the screen. When the device shows the 24-word recovery phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary during setup, it decodes the words and sends them out over LTE through a built-in eSIM. It does not touch the secure element or Ledger OS. Ledger said on 15 October that an organised criminal group bought genuine devices over many months, fitted the implants and returned them to sale through resellers in Southeast Asia, and that it is working with law enforcement.

Ledger has confirmed neither the number of victims nor the losses, and says the figures circulating online come from third parties. On 9 October on-chain researchers estimated more than $72 million (tanuki42) and $86 million (Specter); by 12 October the tracker YFarmX counted about $103 million taken from 530 addresses. Ledger has not announced compensation.

On 13 October Ledger asked its sellers in Southeast Asia and Hong Kong to suspend sales. The same day MediaMarktSaturn pulled Ledger products from its shops and websites in all its countries, a spokesperson told Cointelegraph, after a customer in Germany reported an implant. More claims followed: a researcher posting as Johannes said two Nano X devices from different MediaMarkt stores had added LTE modules, Mark Karpelès said a Ledger Flex he bought at Singapore's airport had an implant, and Tibane Labs described implants in two units bought through Amazon Japan and Yahoo! Auctions Japan. Ledger has confirmed none of these. On 14 October it said it had found no tampering in German retail and distributor stock, including units from the stores named, knew of no implant-related losses in Europe and had not yet examined the devices shown online.

On 15 October Ledger told authorised sellers to keep devices off shelves until sale, never resell returned units and report unusual products.

Is Ledger Recover a backdoor?

It is an optional paid service, not a hidden one, but it changed what Ledger devices are known to be capable of. If you subscribe, the device encrypts a pre-BIP39 version of your private key and splits it into three fragments held by Ledger, Coincover and EscrowTech; two of them can rebuild the key on a Ledger device after an online ID check. If you do not subscribe, nothing leaves the device.

Critics point out that firmware which can export an encrypted key could in principle be changed to do more, and closed-source Ledger OS cannot be fully checked by outsiders. That is why key management scores 88, not in the mid-90s.

Does Ledger stop you from signing a drainer?

Better than most. The device shows what you are signing on its own screen, which malware on your computer cannot change. Blind signingBlind signingApproving a crypto transaction when your wallet shows only a code or hash, not what the transaction will really do.More in the glossary, where the device can only show a hash, is off by default and comes with a warning when you enable it. Ledger's Clear Signing, now based on the open ERC-7730 standard and a generic parser released in 2025, turns contract calls into readable text for any dApp that publishes the metadata. For dApps without it you are back to a warning and a hash.

Ledger data leaks: what was exposed

In June 2020 an attacker used an API key to pull about 1 million email addresses from Ledger's e-commerce database, plus names, postal addresses and phone numbers of 9,532 customers. In December 2020 a fuller file with detailed records of about 272,000 customers, including postal addresses, was dumped online. Ledger said it would not refund customers. In October 2024 France's data regulator, the CNIL, fined a crypto wallet seller €750,000 over data security and retention failures; it did not name the company, but French press identified it as Ledger. For crypto owners, a published home address is a physical risk.

In January 2026 Ledger warned customers that Global-e, the payment partner acting as merchant of record for Ledger.com, had suffered unauthorised access to order data including names and contact details. Ledger said no payment data or recovery phrases were involved; the number affected has not been disclosed.

How to stay safe with a Ledger

1. Buy from ledger.com where you can, and set the device up yourself. Ledger's Genuine Check proves the secure chip is real, but Ledger says it cannot detect added hardware such as spying implants, so even a reseller on Ledger's list is no guarantee. A device that arrives already set up, or with a seed phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary in the box, should never hold funds.
2. Write the 24 words on paper or metal. Ledger will never ask for them, by email, letter, phone or in the app.
3. Consider shipping to a pickup point, and treat any message that knows your order details as suspicious.
4. Keep blind signingBlind signingApproving a crypto transaction when your wallet shows only a code or hash, not what the transaction will really do.More in the glossary off. If a site needs it, find another route or a dApp that supports Clear Signing.
5. Add a passphrase for larger holdings so a stolen seed alone is not enough.

How we scored it

Key management (88) and scam protection (85) are Ledger's strengths: keys in a secure element and readable signing on the device. Security record (75) reflects the 2023 Connect Kit attack, a limited incident with a public post-mortem and a repayment pledge. Company record (38) is the weakest factor because of the 2020 and 2026 data leaks, though it carries only 5% of the score. The CryptoBilis implants are not counted yet: see the editorial notice at the top of this page.

The Connect Kit attack is the main reason MetaMask, a hot walletHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary with no loss traced to its own code, scores a little higher (81) even though a Ledger keeps keys much safer. Trezor scores 83, with fully open firmware and no vendor recovery service.