Ledger

What it is

Ledger makes multi-asset hardware wallets that pair a secure element chip with Ledger's proprietary OS (ledger.com).

At a glance

Current security status

Caution: We don't recommend Ledger for bitcoin-only self-custody right now. If you use one anyway, buy only direct from ledger.com, treat any device that arrives already set up or with a printed seed as compromised, never restore an existing seed onto a device you didn't buy direct, and update only through the official Ledger Wallet app. Minimum version: Latest firmware. Checked Oct 17, 2026 on our security watch.

• Oct 2026: criminals fitted cellular implants into genuine Ledger devices to capture seeds during setup. Galaxy Research says they were sold through CryptoBilis, which Ledger's own site listed as an authorized reseller for Indonesia, Malaysia and the Philippines; even authorized resellers can be compromised. Ledger says the secure element, OS and servers were not compromised.
• Oct 15, 2026: Ledger asked sellers across Asia, including Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong, to halt sales during the investigation.
• Oct 13, 2026: MediaMarkt pulled Ledger devices in Germany as a precaution.
• Anyone who set up a device bought through an affected channel should move funds to a new device and a new seed.
• Oct 15, 2026: Ledger said devices spot-bought from stores in Germany and samples from warehouses were all clean. New partner rules: no Ledger products on shelves or as display stock, and returned devices can never be resold.
• Oct 16, 2026: SlowMist warned of fake firmware-update phishing pages mimicking Genuine Check and Update Now to steal recovery phrases. Update only in the official Ledger Wallet app; never enter your seed on a website.
• Oct 16, 2026: Galaxy Research counted roughly $91 million taken from 474 victim addresses across bitcoin, Ethereum, Arbitrum, Polygon and TRON, including 213 BTC from 279 bitcoin addresses. Galaxy calls its count a floor (a minimum estimate); Ledger has not published loss totals and describes the volume as "limited." Independent teardowns have found at least three generations of the implant. Some victim addresses date to 2021, consistent with existing seeds being restored onto tampered devices: restoring an old seed onto a tampered device exposes it too.
• Source: Ledger response (Oct 15, 2026)
• Source: Galaxy Research (Oct 16, 2026)
• Source: Ledger Wallet app (official)
• Source: BleepingComputer: Asia sales halt
• Source: BleepingComputer: implant confirmed
• Source: CoinDesk (Oct 13, 2026)
• Source: Cointelegraph: MediaMarkt
• Source: SlowMist on X (Oct 16, 2026)
• Source: The Crypto Times: fake update pages

Key features

• Secure element chip in every model (ledger.com).
• Proprietary OS on the device (ledger.com).
• Multi-asset: suits people who also hold other coins; Bitcoin-only users have other options.

October 2026: tampered genuine devices sold through CryptoBilis, a Southeast Asian reseller Ledger's own site listed as authorized, captured seeds, and fake "firmware update" pages are now phishing for recovery phrases. Buy only from ledger.com, update only in the official Ledger Wallet app, and never type your seed into a website. Details below.

Read our full write-up: Is Ledger safe in 2026?

Buying and setup

Every brand: Buy only from the maker's own official store. Even listed or authorized resellers have been compromised. In October 2026, implanted Ledger devices that captured recovery phrases during setup were sold through CryptoBilis, a reseller Ledger's own site listed as authorized for Indonesia, Malaysia and the Philippines (Galaxy Research). Never restore an existing seed onto a device you didn't buy direct from the maker. Treat any device that arrives already set up, or with a printed or pre-filled seed, as compromised. Don't use it.

• Buy only from the maker's own official store (www.ledger.com), not from resellers, even ones it lists as authorized. Never use a device that arrives with a seed already written down.
• Set it up with our hardware wallet module, then pair it with Sparrow as a watch-only wallet.