Ledger
| Industry | Hardware wallets / digital-asset security |
| Founded | 2014 |
| Headquarters | France (Paris and other offices per company page) |
| Website | https://www.ledger.com/ |
Ledger is a French company that designs self-custody hardware wallets and related software for managing digital assets. The company states that it started in 2014. Its consumer line centres on hardware devices paired with the Ledger Live application, with a separate Ledger Enterprise offering for institutional custody infrastructure.[1]
Technology
Ledger describes its devices as using a Secure Element chip and a proprietary operating system. Ledger Live is presented as the companion application for buying, storing, swapping, and managing assets in conjunction with those devices. Enterprise materials describe customisable infrastructure for banks, funds, and high-net-worth clients.[1]
Scale claims
Ledger reports having sold more than 8 million hardware wallets worldwide, with customers in over 200 countries.[2] The company also claims that its devices secure approximately 20% of the world's cryptocurrency assets, although this figure is based on Ledger's own estimates.[3]
Products
Ledger develops hardware wallets that allow users to store and manage private keys for cryptocurrencies, including Bitcoin. The devices use a Secure Element chip and a screen to verify and authorize transactions.
Current devices
- Ledger Nano S Plus – Features an OLED screen, two physical buttons, and USB-C connectivity.
- Ledger Nano X – Features an OLED screen, two physical buttons, Bluetooth, and USB-C connectivity.
- Ledger Nano Gen5 – Features a 2.8-inch E Ink touchscreen, Bluetooth, NFC, and USB-C connectivity.
- Ledger Flex – Features a 2.8-inch E Ink touchscreen, Bluetooth, NFC, and USB-C connectivity.
- Ledger Stax – Features a 3.7-inch curved E Ink touchscreen, Bluetooth, NFC, USB-C, and wireless charging.[4]
Discontinued devices
- Ledger Nano S – Released in 2016 and discontinued in 2022, it was replaced by the Nano S Plus.
- Ledger Blue – A touchscreen device discontinued in February 2020.[5]
Security and privacy
Over the years, vulnerabilities have been identified in Ledger devices, and several security incidents have affected its customers, services, and business partners.
Hardware vulnerabilities (2018–2019)
Between 2018 and 2019, security researchers identified several vulnerabilities in Ledger devices, including supply chain attacks, Bitcoin change address manipulation, and side-channel attacks involving OLED screens. Ledger published security bulletins addressing these vulnerabilities and provided fixes or mitigation measures for the identified issues.[6][7][8]
Customer data breaches (2020)
In June 2020, an attacker gained unauthorized access to Ledger's e-commerce and marketing database. More than one million email addresses were compromised, along with additional personal information belonging to approximately 272,000 customers, including names, postal addresses, and phone numbers. The stolen data was later published on an online forum in December 2020.[9]
Ledger also confirmed that some of its customers were affected by a separate incident involving Shopify, in which unauthorized employees exported order records in April and June 2020.[10]
The exposed data was used in phishing campaigns and fraud attempts targeting customers. In 2021, counterfeit Ledger devices were also sent to customers, accompanied by fraudulent instructions intended to obtain their wallet recovery phrases.[11]
Ledger Recover controversy (2023)
In May 2023, Ledger announced Ledger Recover, an optional service that allows encrypted fragments of a wallet's recovery phrase to be created and distributed among third-party providers to facilitate wallet recovery.
The announcement raised criticism and concerns about the possibility of exporting sensitive information through the firmware and the trust model of the devices. Ledger responded to the criticism and announced additional transparency and open-source initiatives.[12]
Ledger Connect Kit exploit (2023)
On 14 December 2023, an attacker compromised the software publishing account of a former Ledger employee and distributed malicious versions of the Ledger Connect Kit JavaScript library.
The malicious code was loaded by decentralized applications using the library, allowing funds to be stolen from users who approved fraudulent transactions. The incident did not result from a direct vulnerability in the hardware wallets' firmware.[13]
Global-e data breach (2026)
In January 2026, Ledger confirmed that some of its customers had been affected by a data breach involving Global-e, a third-party company responsible for processing certain orders.
The incident exposed names, contact details, and order information, but did not compromise Ledger devices, recovery phrases, or payment information.[14]
Tampered hardware wallets (2026)
In October 2026, Ledger confirmed the discovery of genuine devices that had been physically tampered with by criminals before being sold through resellers in Southeast Asia.
The devices contained hidden electronic components designed to capture the recovery phrase during initial setup, potentially allowing unauthorized access to users' funds.
Singapore police confirmed at least two cases, with combined losses of approximately SGD 3.5 million. According to Ledger, the attack targeted the distribution chain and did not result from a vulnerability in the devices' original chips or firmware.[15][16]
See also
External links
References
- ↑ 1.0 1.1 Ledger: The company
- ↑ "Ledger Careers". Ledger. https://careers.ledger.com/.
- ↑ "The Ledger Nano: Which One's For You?". Ledger. https://www.ledger.com/academy/the-world-of-nano-which-ones-for-you.
- ↑ "Compare Ledger Hardware Wallets". Ledger. https://shop.ledger.com/pages/hardware-wallets-comparison.
- ↑ "Ledger OS and Device Apps Policy". Ledger. https://shop.ledger.com/pages/ledger-os-and-device-apps-policy.
- ↑ "Ledger Security Bulletin 002". Ledger Donjon. https://donjon.ledger.com/lsb/002/.
- ↑ "Ledger Security Bulletin 004". Ledger Donjon. https://donjon.ledger.com/lsb/004/.
- ↑ "Ledger Security Bulletin 006". Ledger Donjon. https://donjon.ledger.com/lsb/006/.
- ↑ "Message by Ledger's CEO – Update on the July data breach". Ledger. 21 December 2020. https://www.ledger.com/message-ledgers-ceo-data-leak.
- ↑ "Update: Efforts to Protect Your Data and Prosecute The Scammers". Ledger. 13 January 2021. https://www.ledger.com/blog/update-efforts-to-protect-your-data-and-prosecute-the-scammers.
- ↑ "Ledger customers targeted by fake hardware wallets in the mail". BleepingComputer. 17 June 2021. https://www.bleepingcomputer.com/news/cryptocurrency/ledger-customers-targeted-by-fake-hardware-wallets-in-mail/.
- ↑ "Ledger Recover: A Message From Pascal Gauthier, Chairman & CEO at Ledger". Ledger. 23 May 2023. https://www.ledger.com/blog/ledger-recover-a-message-from-pascal-gauthier-chairman-ceo-at-ledger.
- ↑ "Security Incident Report". Ledger. 20 December 2023. https://www.ledger.com/blog/security-incident-report.
- ↑ "Ledger customers impacted by third-party Global-e data breach". BleepingComputer. 5 January 2026. https://www.bleepingcomputer.com/news/security/ledger-customers-impacted-by-third-party-global-e-data-breach/.
- ↑ "Ledger's Response to the Hardware Implant Attack". Ledger. 15 October 2026. https://www.ledger.com/blog-response-hardware-implant-attack.
- ↑ "Police Advisory On Tampered Cryptocurrency Hardware Wallets". Singapore Police Force. 28 October 2026. https://www.police.gov.sg/Media-Hub/News/2026/10/20261028_police_advisory_on_tampered_cryptocurrency_hardware_wallets.