Is Ledger safe?

Ledger’s record from 2020 to 2026 includes customer-data leaks, a compromised software library and published research on its hardware, but none shows a recovery phrase extracted from a Ledger that had been set up and locked with a PIN. In the Ledger reports we reviewed, losses came from phishing that got people to enter their 24-word recovery phrase on a website or app (phishing letters point to such sites), or from malicious transactions users signed, as in the 2023 Connect Kit incident.

We have not tested Ledger devices; the events below come from our dataset, each with its source.

Has Ledger been hacked? A dated timeline

• 25 June 2020, customer data leak. An unauthorised party used an API key to read Ledger’s e-commerce and marketing database: about 1 million email addresses, plus names, postal addresses and phone numbers for 9,500 customers, according to Ledger’s disclosure of 29 July 2020. Ledger deactivated the key and said no payment data or passwords were involved.
• 8 July 2020, device research. Kraken Security Labs showed that a Nano X intercepted before its first app was installed could have its non-secure chip reflashed to act as a keyboard on the host computer or to switch off the screen. Ledger’s Security Bulletin 013 says firmware 1.2.4-2 makes the Secure Element check that chip’s integrity at every boot, and that debug interfaces are disabled on newly made devices.
• 20 December 2020, customer data leak. The stolen database was posted on a forum. Ledger’s CEO wrote that it held about 272,000 detailed records (names, postal addresses, phone numbers), more than Ledger’s logs had shown, and that the leak had no impact on the hardware wallets, the app or funds.
• 17 May 2021, protocol flaw. Ledger disclosed a weakness in the secure channel used to install apps and firmware, fixed in Nano X firmware 1.3.0, and reported no impact on device security.
• 22 June 2021, physical phishing. Modified Nano X units were mailed as unsolicited “replacements” with a fake CEO letter and a hidden USB stick carrying a phishing app. Kraken’s analysis states the scam did not exploit a flaw in the Ledger wallet or its firmware.
• May 2023, Ledger Recover dispute. Addressing concern over Recover, Ledger’s CEO said on 23 May 2023 that Ledger would speed up open-sourcing its operating system and the Recover protocol, hold Recover until that work was done, and keep the service fully optional.
• 14 December 2023, software supply chain. A former employee’s npm account was phished and used to publish malicious versions 1.1.5 to 1.1.7 of Ledger Connect Kit, a JavaScript library that third-party apps load to talk to Ledger devices. Users who signed the injected transactions were drained. Ledger’s report says a genuine version was live within 40 minutes of Ledger becoming aware, and CDN caching stretched full resolution to about five hours.
• 10 January 2025, firmware flaw. A missing check during firmware updates could permanently brick a device (LSB 021). Fixed in Nano X 2.4.2, Flex 1.2.2 and Stax 1.6.2 or later; Ledger states client funds were never at risk.
• 5 January 2026, partner data leak notified. Global-e, an e-commerce partner Ledger uses for local-currency purchases, began emailing customers that day about a breach that exposed Ledger customers’ names, contact details and order details (The Register). Both companies said financial data, passwords and recovery phrases were not affected; phishing emails citing the incident had already started.

Model-level detail is on the Nano X, Nano S Plus, Nano Gen5, Flex and Stax datasheets.

Device compromise, data leaks and phishing: what is the difference?

Device compromise, as this guide uses the term, means an attacker extracts the keys or makes the device sign something the owner did not approve. The 2020 research needed a Nano X tampered with before its first app was installed, and the 2025 bulletin concerned bricking, not key access. Ledger’s threat model says its Genuine Check proves the Secure Element is genuine but cannot detect physical implants added to an otherwise genuine device, which is why Ledger recommends buying from itself or authorised resellers.

Data leaks in 2020 and 2026 exposed who bought a Ledger and how to reach them (postal addresses in 2020), not their keys, giving scammers a target list. Responding in December 2020 to customers worried about physical threats, Ledger’s CEO pointed to two features: the device resets after three wrong PIN entries, and a BIP39 passphrase can be attached to a second PIN that opens a separate set of accounts.

Software supply-chain attacks, such as Connect Kit, target the code between the user and the device. The device screen is the last check: Ledger’s incident report says it promotes clear signing so users can read on the device what they approve.

Phishing goes after the recovery phrase itself. Ledger’s phishing page notes that anyone with the phrase has full access to every account created from it, so no device feature protects a phrase typed into a website or app (see our seed phrase guide).

Is Ledger a scam?

Ledger is a hardware maker with a company address in Paris, listed on its shop’s comparison page, and sells through its own store and authorised resellers. The scams that use its name are run by third parties impersonating it, and not only Ledger is targeted: Trezor reported in January 2024 that unauthorised access to its support portal was used to send seed-phishing messages (see Ledger vs Trezor).

How do Ledger phishing scams work?

Ledger’s list of ongoing phishing campaigns describes these patterns:

• Emails imitating Ledger or its partners, including one built around the Global-e incident.
• Letters by post with a QR code or web address leading to a form that asks for the 24 words. Another letter claims Ledger has opened “vault” addresses and nudges recipients to send funds to them.
• Phone calls. A scammer opens a support ticket with the victim’s email address so a genuine Ledger auto-reply arrives, then calls to say the account is compromised. Others pose as staff of Coincover, Ledger’s Recover partner, or claim someone tried to recover the victim’s wallet from another country.
• Fake Ledger Wallet apps and websites that show an invented error and ask for the recovery phrase. Ledger calls fake versions of its app one of the most common tactics it sees.
• Fake replacement devices sent unsolicited, as in the 2021 case above.
• Scam NFTs and tokens airdropped into accounts, pointing to sites where “claiming” them triggers a contract that drains the wallet.
• Fake social media accounts posing as Ledger support or staff, pushing users into direct messages.
• “Deactivation” threats claiming Ledger will block the device for identity checks. Ledger states it cannot do this.

How can you spot a Ledger scam?

These rules come from Ledger’s phishing page and its buying guide:

1. Ledger never asks for the 24 words. The only place to enter them is the Ledger device itself.
2. Ledger does not contact customers by text message or phone call. Treat any “Ledger” message by SMS, WhatsApp, Telegram, phone or post as phishing.
3. Ledger does not email requests to update firmware or enable two-factor authentication.
4. Check the sender’s domain. Ledger lists @ledger.com, @ledger.fr, @ledgerwallet.com and @ledger.zendesk.com as authentic; lookalikes swap letters, such as “legder”.
5. Never approve a transaction you did not start, and read the address and amount on the device screen.
6. Get Ledger Wallet only from ledger.com/ledger-live or the official mobile app stores.
7. Do not plug in a device you did not order. If a device arrives with a recovery phrase or PIN already supplied, Ledger advises not using it.
8. Report impersonation to phishing@ledger.fr, the address on Ledger’s phishing page.

Is Ledger Live safe?

Ledger Live is now called Ledger Wallet. Its code is published under the MIT licence in Ledger’s GitHub repository, which notes the old name. Ledger states that the recovery phrase leaves the Secure Element only as encrypted Ledger Recover fragments, after the owner enters the PIN and approves on the device. The 2023 Connect Kit compromise hit a separate library used by third-party apps, not the Ledger Wallet app.

The documented risk is fake copies of the app. Ledger’s Genuine Check, run from the app, asks the device’s Secure Element to prove it is genuine, but Ledger warns that counterfeit devices can ship with a modified app that reports “genuine” anyway, so the check counts only with an app from the sources in rule 6 above.

Does Ledger Recover make a Ledger less safe?

Ledger Recover is a paid, opt-in subscription. The device encrypts a pre-BIP39 form of the private key, splits it into three fragments and sends them to Coincover, Ledger and EscrowTech; restoring needs two of the three plus identity checks by two independent companies. Recovery then also depends on those companies and on ID verification; owners who do not subscribe keep managing their own recovery-phrase backup.

On code review, Ledger says its operating system and software are 95% open source and/or available, with the rest withheld under its agreement with chip maker STMicroelectronics. For other makers, see Tangem vs Ledger and Ledger vs Trezor, or read about self-custody.

What we could not verify

• How many customers the Global-e breach affected, and when the breach itself happened: the report we cite gives neither, and Ledger’s own support article on the incident would not load for us.
• Total losses from Connect Kit: Ledger’s report gives no figure.
• Whether the 2020 Kraken findings apply beyond the Nano X: Ledger’s bulletin names only that model.
• Current Ledger Recover pricing for each country. Availability depends on the country that issued the subscriber’s ID, and renewal costs in local currency can vary with exchange rates.