Amidst security concerns and reported breaches, the question of “is Ledger safe?” merits a clear and direct answer.
In this article, we take a no-nonsense look at Ledger’s security infrastructure, prior vulnerabilities, and user best practices for safeguarding your crypto assets.
- Ledger experienced security breaches, including a major customer information leak in 2020 and a malicious code injection in 2021, prompting a need for enhanced security measures in the cryptocurrency industry.
- Ledger continues to innovate with new hardware wallet models and features, maintaining a robust security framework involving Secure Element chips, a proprietary BOLOS operating system. It also continuously invests in user education through Ledger Academy.
- Ledger pushes continuous firmware updates, and employs ethical hacking by the Ledger Donjon team, and recovery options to ensure users’ digital assets remain protected across a wide range of supported cryptocurrencies.
Key Takeaways
- Ledger experienced security breaches, including a major customer information leak in 2020 and a malicious code injection in 2021, prompting a need for enhanced security measures in the cryptocurrency industry.
- Ledger continues to innovate with new hardware wallet models and features, maintaining a robust security framework involving Secure Element chips, a proprietary BOLOS operating system. It also continuously invests in user education through Ledger Academy.
- Ledger pushes continuous firmware updates, and employs ethical hacking by the Ledger Donjon team, and recovery options to ensure users’ digital assets remain protected across a wide range of supported cryptocurrencies.
Is Ledger Safe?
Ledger makes hardware wallets with advanced security features, designed to protect your digital assets from the multiple threats that exist in the cryptocurrency landscape. The main selling point of these wallets is for customers to keep private keys offline and away from potential online threats with a Secure Element chip for added protection.
In general, having a hardware wallet is much more secure than storing crypto online. But is Ledger safe for everyone?
Recent Security Incidents Involving Ledger
Despite Ledger’s claims and reassurances about its security model, the company has been embroiled in multiple controversies. As recently as December 2023, a breach in Ledger’s ConnectKit library drained hundreds of thousands of dollars from multiple users.
And, of course, in December 2020, Ledger suffered a major data breach that compromised customer information, leading to targeted phishing attacks.
Ledger’s CEO, Pascal Gauthier, referred to the phishing attack as an unfortunate but isolated incident. Nevertheless, it underscored the need for increased security measures in the cryptocurrency industry, particularly regarding the browser-based signing of transactions with decentralized applications.
Ledger’s Response to the 2023 Github Code Exploit
How did Ledger respond to the recent 2023 Github code exploit? Admirably, the company responded rapidly and efficiently.
Within 40 minutes of discovering the malicious code in the Ledger ConnectKit, the company deployed a corrected version and worked with WalletConnect to deactivate the compromised code. However, due to delays in CDN caches updating globally, the malicious code remained accessible for approximately five hours.
Beyond technical measures, Ledger worked with Tether to freeze the attacker’s transferred funds and made coordinated efforts to disable the rogue instance of ConnectKit. The root cause of the exploit was traced back to a failure to revoke the NPMJS access rights of a former employee, leading to the introduction of the malicious code.
Phishing Attack: An Isolated Incident or a Warning Sign?
The phishing attack was indeed a wake-up call.
In December 2021, a former Ledger employee’s NPMJS account was exploited. The attacker injected malicious code into Ledger’s ConnectKit, resulting in users inadvertently signing transactions that drained their wallets.
This ConnectKit hack was estimated to have cost users $480,000.
This security breach also affected various DeFi platforms using the compromised Connect Ki, including:
- Sushi
- Lido
- Metamask
- Coinbase
Just like in 2020, Gauthier conducted damage control once again and ensured the public and customers that this was an unfortunate but isolated incident. However, these major exploits and breaches have consistently plagued Ledger customers. It underscores the need for increased security measures, particularly regarding the browser-based signing of transactions with decentralized applications.
Ledger’s Balance of Innovation and Safety
Although Ledger has experienced security incidents, it hasn’t been deterred from continuing to innovate.
Ledger integrated its hardware wallets with the Ledger Live app to streamline the crypto asset management and interaction with dApps and Web3 services.
Newer models like the Ledger Nano S Plus and Ledger Nano X incorporate user-friendly features including touchscreens and wireless connectivity, reflecting the company’s dedication to combining security with convenience.
However, Ledger acknowledges that with innovation comes exposure to more attacks, and it has taken measures to mitigate these risks.
How Does Ledger Ensure Security?
Ledger is often regarded as one of the best cold wallets due to its commitment to security. Here is what makes up Ledger’s security model:
- Certified Secure Element chip
- Proprietary operating system
- PIN code
- Recovery phrase
- Regular updates
- Ethical hacking
- User-focused measures
All of these features are engineered to offer robust protection for your digital currencies.
Certified Secure Element Chip
At the heart of Ledger’s security is the Secure Element chip, a military-grade component that protects your private keys and ensures the security of your digital assets.
It’s certified by an independent third party to confirm its resilience against complex attacks and test the chip’s built-in countermeasures against recognized attack vectors.
Furthermore, at each boot, the Secure Element checks for any signs of tampering, with Ledger providing proof to verify that the chip is genuine and unmodified. This level of security is similar to what credit cards and passports use, offering an enhanced level of protection for sensitive information like private keys.
BOLOS: A Fortress for Your Digital Currencies
The security provided by Ledger surpasses the Secure Element chip with the inclusion of its custom-made operating system, BOLOS (Blockchain Open Ledger Operating System).
The BOLOS system enhances security by managing private keys, enforcing device and app rules, and isolating information for different applications.
BOLOS creates a secure environment where each application runs in its own memory region, protecting against various types of attacks and ensuring that core hardware wallet functions are shielded from malicious third-party apps.
The Ledger Blue utilizes the ARM Memory Protection Unit. Different Operating Modes within BOLOS to ensure that applications access only their designated memory space.
PIN Code and Recovery Phrase
PIN codes and recovery phases are somewhat mundane security measures but vital to keeping you safe. You require a 4- to 8-digit PIN code for any action on a Ledger device, which acts as the primary layer of security for everyday use. Users are advised to create a strong PIN code during the initial setup, avoiding easy-to-guess combinations such as birthdays.
Additionally, Ledger devices generate a 24-word Secret Recovery Phrase, ensuring a high level of security with 256 bits of entropy. This phrase is crucial as it allows the restoration of a user’s entire crypto wallet, including the private key, on a new device or interface, and, therefore, must be recorded accurately to prevent loss of access to funds.
Continuous Security Updates
Security is an ongoing process of continuously strengthening defenses. Ledger embodies this philosophy by maintaining a robust defense strategy against attacks, which includes technical innovation, ongoing rigorous testing, and comprehensive user education.
The company is committed to enhancing policies on code review, deployment, distribution, and access controls, with a third-party audit scheduled for early 2024.
Ledger even has a bounty program in place to incentivize the discovery and reporting of potential vulnerabilities. Firmware updates are regularly released to address new threats and vulnerabilities, constantly improving the security of Ledger hardware wallets.
Ledger Donjon: Ethical Hacking for Better Security
In a distinctive strategy to boost security, Ledger has an in-house security team, Ledger Donjon, consisting of top-tier security researchers and ethical hackers. The Donjon team uses a variety of attack simulations, including fault, side-channel, and software attacks, to pinpoint potential system vulnerabilities. Thanks to their rigorous testing and research, continuous improvements are made to Ledger’s security protocols and firmware, reinforcing user confidence in the safety of their crypto assets.
User-Centric Security Measures
Ledger’s security approach goes beyond the physical device; it extends to user-centric measures like education and best practices.
Ledger Live, the interface for managing Ledger wallets, offers features like password protection and auto-lockout, alongside market value tracking.
Ledger also advocates for the following strategic approach to mitigate risks and enhance the security of stored assets:
- Segregating assets into mint, sell, and vault accounts
- Protecting the Secret Recovery Phrase
- Encouraging caution regarding information shared online to guard against threats and social engineering
How to Use Ledger Safely: Safeguard Your Crypto
Although Ledger makes constant attempts to improve security, users still need to learn how to use the wallets and services safely.
Safeguarding Your Recovery Phrase
One of the vital elements of securely using Ledger is the protection of your Secret Recovery Phrase. This phrase should be stored in a safe, fireproof, and waterproof place, such as the Ledger-recommended BillFODL or the Crypto Steel Capsule Solo. Ensure you write each word from the BIP-319 list in the correct order.
Keeping a physical copy of your recovery phase is crucial. If you lose your wallet, you’ll need to use your Secret Recovery Phase to regain access. Don’t try to regain access from memory. Having this phrase offline ensures no malicious party can access it unauthorized.
Avoiding Common Pitfalls
Like any technology, there are certain practices to avoid when using Ledger. One such practice is blind signing, which is when you verify a transaction without going over all the details. Always double-check a transaction’s details before approving it.
To ensure transaction authenticity, follow these steps:
- Compare the details on your Ledger device’s screen with information on other screens.
- Consider doing a test transaction for newly added addresses.
- Exercise caution when interacting with smart contracts — always check the contract addresses.
- Segregate your crypto assets across different accounts for various interactions.
- Verify and sign transactions using a trusted device or platform.
Phishing scams are also a common occurrence in the crypto world. Be wary of too-good-to-be-true offers, avoid clicking on suspicious links, and stay informed about past Ledger-related phishing incidents.
Performing Regular Security Check-Ups
Regular security check-ups are a crucial part of maintaining the safety of your Ledger devices. Ensure you update Ledger devices through the Ledger Live application to stay up-to-date on security measures. Notifications for firmware updates are delivered via the Ledger Live application, allowing users to benefit from the latest security improvements.
Additionally, Ledger’s Recovery Check app enables users to verify that the recovery phrase they have written down matches the one protecting their device.
How to Recover Your Ledger Wallet
Ledger supports a wide array of digital assets, including:
- Bitcoin
- Ethereum
- Ripple
- Litecoin
- Bitcoin Cash
- Cardano
- Stellar
- EOS
- and over 5,000 more
This makes it a versatile choice for cryptocurrency enthusiasts, as you can store various types of digital assets on your Ledger device.
Ledger Live is a one-stop shop for managing your digital assets, allowing users to see their balances and live markets while also ensuring a smooth recovery process when needed.
Comparing Ledger to Other Hardware Wallets
While Ledger offers robust security features, it’s important to understand how it compares with other wallets, like Trezor and KeepKey.
| Name | Ledger Stax | Trezor Model T | KeepKey | SafePal S1 |
| Supported currencies | 5,500+ | 8,000+ | 700+ | Unlimited |
| Price | $279 | $179 | $99 | $49.99 |
| Open Source? | No | Yes | Yes | Yes |
| Interfaces | USB, Bluetooth | USB | USB | USB, Bluetooth |
| Platform | Windows, macOS, Linux, Android, Chrome OS, iOS | Windows, macOS, Linux, Android | Windows, macOS, Linux, Android | Windows, macOS, Linux, Android, iOS |
| Secure Element | Yes | Yes | No | No |
Check out our curated list of the best cold wallets here.
More details
Ledger Stax is the markets most stylish cryptocurrency hardware wallet with NFT customized lock screen, user-friendly touchscreen, Bluetooth-enabled device and supports 5500+ altcoins. Its Qi charging technology makes a single last for months.
-
Large-sized e-ink screen for easy usability.
-
Bluetooth-enabled connectivity.
-
Sturdy and transportable case
-
Best design in the industry.
-
Higher cost than its competitors
-
Restricted scalability selection.
-
Not broadly adopted.
More details
The Ledger Nano X is a must-have, secure hardware wallet for cryptocurrency. It features easy mobile pairing, a sleek design, Bluetooth support, and robust security features like a safe chip and two-factor authentication.
-
Supports 5500 various cryptocurrencies.
-
Private keys are encrypted.
-
Desktop and mobile devices are supported.
-
Bluetooth enabled.
-
Allow 100 apps storage.
-
Fairly overpriced against the competition.
-
Only 100 apps are allowed.
-
Bluetooth works solely with mobile.
More details
Ledger Nano S Plus is a fortress-like protection for your digital wealth, sporting an affordable price point. This crypto wallet supports many cryptocurrencies and blockchain networks, making them easily managed via the reputable Ledger Live app. Despite its significant advantages, some users have noted the lack of storage capacity.
-
Support for up to 5,500 cryptocurrencies.
-
Private keys are always offline.
-
Integration with other hot wallets.
-
Support for staking.
-
NFT support.
-
High fees for Ledger Live crypto purchases.
-
Limited app space.
-
Small display.
What Sets Ledger Apart?
One distinguishing aspect of Ledger is its employment of Secure Element chips. Ledger is the only Web3 hardware wallet provider to use these chips, which add an extra layer of security beyond standard chips. Moreover, users can configure specific accounts within their Ledger hardware wallet, isolating valuable assets from online threats.
Alternatives in the Hardware Wallet Space
When exploring other hardware wallets, Trezor stands out with its distinctive Shamir Backup feature, which distributes recovery shares to increase safety. Unlike Ledger, Trezor has opted for a fully open-source software model, so the public can examine its security. However, due to security considerations, Trezor does not support Apple’s iOS. KeepKey is also open-source but supports fewer cryptocurrencies, allowing for more careful control over operations.
Summary
In conclusion, Ledger continues to be a reliable name in the realm of hardware wallets. Despite facing security incidents, the company has shown resilience and commitment to maintaining robust security for its users. Ledger’s use of Secure Element chips, its custom BOLOS operating system, and user-centric security measures set it apart in the hardware wallet space. While alternatives like Trezor and KeepKey have their unique offerings, Ledger’s extensive cryptocurrency support and commitment to continuous security updates keep it a top choice for crypto enthusiasts.
No, hackers can reveal sensitive account information through phishing, which could give them access to your funds. However, someone can't just hack into your offline wallet. Ledger doesn't store your private keys, according to them.
While there have been controversies in the past, the Ledger team have responded quickly and decisively each time, on top of continuous security improvements.
Yes, Ledger is safer than Coinbase because it stores your cryptocurrency offline on a physical device, making it much more secure than using a software wallet like Coinbase.
Hackers targeted DeFi platforms connected to hardware wallets by inserting malicious code into the widely used ConnectKit javascript library on GitHub.
Ledger took swift action by working with WalletConnect to remove and deactivate the malicious code within 40 minutes of discovery. This demonstrates their commitment to promptly addressing security issues.
