It depends on what you need it to survive. Ledger runs hardware wallet custody, with no single point of failure recorded: no one institution's failure reaches your bitcoin on its own. Proof of Custody scores it 59/100 as of 2026-08-03. Single-signature hardware wallet is a good fit for learning self-custody with amounts you can afford to lose while you learn, and the wrong choice for life savings: one firmware defect, one coerced evening, or one lost seed is total loss — one failure domain is the whole story. The score is an editorial judgement; the facts to check are the custody model, the single point of failure and the incident history below.
| Custody model | Hardware Wallet Proof of Custody classification from the provider's own documents |
|---|---|
| Single point of failure | No: no single party can move or lose the holding alone Record as of 2026-08-03 |
| Who holds the keys | Not published in enough detail to state |
| Independence standard | 0 of 4 pillars met |
| Insurance | Not disclosed by the provider |
| Regulatory standing | Not published |
| Qualified custodian | Not stated |
| Incidents in the registry | Ledger customer database breach (July 2020): Vendor data, loss No direct bitcoin loss |
| Fees | ~$80 - $280 Provider pricing page; verify before relying on it |
| Minimum | $0 |
| Proof of Custody score | 59/100 Editorial judgement on the published methodology, as of 2026-08-03 |
Facts come from the provider's own documents and public filings, with the date they were last checked. The score is Proof of Custody's judgement. Dispute a row through the corrections process.
Signing devices are scored on six dimensions weighted toward key generation, rather than on the rubric used for custody services. Assessment as of August 3, 2026.
Certified secure element with a hardware random number generator. No publicly documented defect in the entropy path. The generation process is not independently verifiable by the holder because the firmware is closed.
The secure-element firmware is closed source and cannot be independently audited or reproducibly built. The 2023 Ledger Recover announcement demonstrated that firmware capable of extracting seed material could be delivered by update, which changed how many holders understood the device's trust model.
Genuine-device attestation is strong. Broad retail distribution widens the surface relative to direct-only sales.
Acknowledged the 2020 breach and has published incident detail. Communication around Ledger Recover was widely criticised as unclear about the underlying capability.
Broad wallet compatibility, standard descriptors, and miniscript support in stable firmware. Recovery does not depend on Ledger's own software.
The 2020 e-commerce breach exposed roughly a million email addresses and a subset of detailed delivery records including names, physical addresses, and phone numbers. Those records continue to drive targeted phishing and physical-coercion risk six years later. This is a permanent, unfixable exposure for affected customers and is the clearest example of why data handling belongs in a custody score.
Most popular hardware wallet globally. Broad app ecosystem.
Closed-source secure element. Ledger Recover controversy. Physical exposure.
1 independent party or system must fail before a Ledger holder's bitcoin is at risk.
Ledger's custody insurance is not publicly disclosed.
Ledger uses a hardware wallet model and scores 59/100 in our independent review, including 65/100 on custody security. No single institution can unilaterally move funds. Safety depends on your priorities; see the full score breakdown above.
Ledger's custody insurance is not publicly disclosed in a form we can verify. Where it exists, custody insurance covers specific named events up to shared limits and does not cover price loss. Confirm coverage in writing before relying on it.
Ledger's architecture distributes control, so no single institution's failure alone can move or lose your bitcoin. Recovery depends on the specific structure; see the custody section above.
Ledger does not advertise a dedicated inheritance or beneficiary feature in the data we track. Confirm current options with the provider, since custody inheritance handling changes.