Signing devices are scored on six dimensions weighted toward key generation, rather than on the rubric used for custody services. Assessment as of August 3, 2026.
Certified secure element with a hardware random number generator. No publicly documented defect in the entropy path. The generation process is not independently verifiable by the holder because the firmware is closed.
The secure-element firmware is closed source and cannot be independently audited or reproducibly built. The 2023 Ledger Recover announcement demonstrated that firmware capable of extracting seed material could be delivered by update, which changed how many holders understood the device's trust model.
Genuine-device attestation is strong. Broad retail distribution widens the surface relative to direct-only sales.
Acknowledged the 2020 breach and has published incident detail. Communication around Ledger Recover was widely criticised as unclear about the underlying capability.
Broad wallet compatibility, standard descriptors, and miniscript support in stable firmware. Recovery does not depend on Ledger's own software.
The 2020 e-commerce breach exposed roughly a million email addresses and a subset of detailed delivery records including names, physical addresses, and phone numbers. Those records continue to drive targeted phishing and physical-coercion risk six years later. This is a permanent, unfixable exposure for affected customers and is the clearest example of why data handling belongs in a custody score.
Most popular hardware wallet globally. Broad app ecosystem.
Closed-source secure element. Ledger Recover controversy. Physical exposure.
1 independent party or system must fail before a Ledger holder's bitcoin is at risk.
Ledger's custody insurance is not publicly disclosed.
Ledger uses a hardware wallet model and scores 59/100 in our independent review, including 65/100 on custody security. No single institution can unilaterally move funds. Safety depends on your priorities; see the full score breakdown above.
Ledger's custody insurance is not publicly disclosed in a form we can verify. Where it exists, custody insurance covers specific named events up to shared limits and does not cover price loss. Confirm coverage in writing before relying on it.
Ledger's architecture distributes control, so no single institution's failure alone can move or lose your bitcoin. Recovery depends on the specific structure; see the custody section above.
Ledger does not advertise a dedicated inheritance or beneficiary feature in the data we track. Confirm current options with the provider, since custody inheritance handling changes.