Ledger

Is Ledger safe?

The device is; the company around it has stumbled. A Ledger hardware walletHardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary keeps your keys on a secure element chip that never connects to the internet, and every transaction has to be approved on its own screen. No Ledger device has been compromised remotely. We score Ledger 78/100, a B, held back by a 2023 supply-chain attack on its software and by two leaks of customer data that included home addresses.

For most people moving savings off an exchange or out of a hot walletHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary like MetaMask, a hardware wallet such as Ledger is still a big step up in key security. The weaknesses are mostly about your privacy and about the software that sits between the device and websites.

What happened in the Ledger Connect Kit attack?

On 14 December 2023 a former Ledger employee was phished. Ledger had revoked their access to internal systems but not to npm, the package registry. The attacker used it to publish malicious versions 1.1.5 to 1.1.7 of Ledger Connect Kit, a library many dApps load to talk to Ledger devices, between 09:49 and 11:37 CET.

The code swapped real transaction requests for drainerDrainerA malicious website or script that tricks a crypto user into signing a transaction or approval that lets attackers empty the wallet.More in the glossary requests from the Angel Drainer kit. Users who approved them lost funds. It took about five hours to clean up fully, though Ledger put the active draining window at under two hours. Ledger estimated about $600,000 in assets were affected and promised to repay all victims, including people who were not its customers. We did not find a final confirmation that every claim was paid.

This was Ledger's own distribution channel, so it counts against the security record. A clear post-mortem and a full repayment pledge keep the score at 75 rather than lower.

The CryptoBilis drains (October 2026)

On 9 October 2026 Ledger said it was investigating reports of lost funds from users in Southeast Asia who had bought its devices from CryptoBilis. CryptoBilis is listed on Ledger's own reseller page for Indonesia, Malaysia and the Philippines. Ledger asked it to pause all sales and shipments, and told anyone who bought from it in the last 90 days not to set up their device, or to move their assets to a new device with a new seed.

How the wallets were drained is not yet known. On-chain researcher tanuki42 counted more than $72 million moved to suspected theft addresses, and another, Specter, more than $86 million across Bitcoin, Ethereum and Tron; Specter later said the number of victim wallets was not yet known. Binance co-founder Changpeng Zhao said the information pointed to a supply-chain attack through one vendor, and Mark Karpeles, once head of Mt. Gox, asked victims for circuit-board photos to check for tampering. Ledger itself has not named a cause, and had posted no update by 10 October.

CryptoBilis is a channel Ledger itself recommends, so if tampered devices or pre-set seeds are confirmed, this will count against the security record. Until then the score is unchanged, with lower confidence.

Is Ledger Recover a backdoor?

It is an optional service, not a hidden one, but it changed what Ledger devices are known to be capable of. If you subscribe, the device encrypts a pre-BIP39 version of your private key, makes copies and splits it into three fragments, held by Ledger, Coincover and EscrowTech. Any two can send their fragments back to a Ledger device to rebuild the key after Coincover verifies your ID. Ledger says each fragment is useless alone, recovery is limited to three attempts a month and Coincover may pay up to $50,000 if something goes wrong.

If you do not subscribe, nothing leaves the device. Critics' point, made loudly at the 2023 launch, is that firmware which can export an encrypted key for Recover could in principle be changed to do more, and Ledger OS is closed source, so outsiders cannot fully check. That is why key management scores 88, not in the mid-90s. Whether ID-based recovery suits you is a personal trade-off; a seed on metal in a safe place has no third party at all.

Does Ledger stop you from signing a drainer?

Better than most. The device shows what you are signing on its own screen, which malware on your computer cannot change. Blind signingBlind signingApproving a crypto transaction when your wallet shows only a code or hash, not what the transaction will really do.More in the glossary, where the device can only show a hash, is off by default and comes with a warning when you enable it. Ledger's Clear Signing work, now based on the open ERC-7730 standard and a generic parser released in 2025, turns contract calls into readable text for any dApp that publishes the metadata.

The limit is adoption: for dApps without that metadata you are back to a warning and a hash.

Ledger data leaks: what was exposed

This is Ledger's weakest area. In June 2020 an attacker used a misconfigured API key to pull about 1 million email addresses from Ledger's e-commerce database, plus detailed records for 9,532 customers. In December 2020 a fuller file was dumped online with names, phone numbers and postal addresses of about 272,000 customers. Ledger said it would not compensate them. In October 2024 France's data regulator, the CNIL, fined it €750,000 over data security and retention failures linked to these leaks. For crypto owners, a published home address is a physical risk.

In January 2026 Ledger warned customers that Global-e, the payment partner acting as merchant of record for Ledger.com, had suffered unauthorised access to order data including names and contact details. Ledger said no payment data or recovery phrases were involved. The number affected has not been disclosed. Two leaks of physical details put company record at 38.

How to stay safe with a Ledger

1. Buy from ledger.com, or from a reseller on Ledger's official list, then set it up yourself and run the genuine check in Ledger Wallet. A device that arrives already set up, or with a seed phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary in the box, should never hold funds.
2. Write the 24 words on paper or metal. Ledger will never ask for them, by email, letter, phone or in the app.
3. Consider shipping to a pickup point, and treat any message that knows your order details as suspicious.
4. Keep blind signingBlind signingApproving a crypto transaction when your wallet shows only a code or hash, not what the transaction will really do.More in the glossary off. If a site needs it, find another route or a dApp that supports Clear Signing.
5. Add a passphrase for larger holdings so a stolen seed alone is not enough.

Compared with Trust Wallet, Ledger's 2023 incident was smaller and better explained, but its data record is much worse.

How we scored it

Key management (88) and scam protection (85) are Ledger's strengths: keys in a secure element and readable signing on the device. Key management sits just below 90 because Recover shows the firmware can export the key. Company record (38) is the weakest factor because of the 2020 and 2026 customer-data leaks, though it carries only 5% of the score, and security record (75) reflects the 2023 Connect Kit attack. It does not yet reflect the CryptoBilis drains, whose cause is unknown.

That attack, and to a lesser degree the data leaks, is why MetaMask, a hot walletHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary with no loss traced to its own code, still scores a little higher overall even though a Ledger keeps keys much safer. Trezor scores higher too, with fully open firmware and no vendor recovery service.