I’ve seen many discussions around Ledger on other forums and it seems their reputation is so bad. Here’s an example: Reddit - The heart of the internet
Ledger can’t be trusted anymore. Here’s a summary of the many reasons why, with links to cite sources.
1: Ledger’s word can’t be trusted. The following was a lie:
Your keys are always stored on your device and never leave it
SOURCE: btchip, Ledger Co-Founder, on May 14th, 2023
That’s a lie because Ledger added a key extraction API to their firmware which enables Ledger and their partner companies (and others?) to extract your keys from your hardware wallet over the internet. Might as well stop reading right there. It can’t be trusted.
2: Ledger’s code can’t be trusted. It can’t be verified:
There’s no backdoor and I obviously can’t prove it
SOURCE: btchip, Ledger owner & co-founder
Ledger can’t prove their code has no backdoors because their code is closed source. The only way to prove their code is safe would be to open up the code. All of the code. Closed source code can’t be trusted.
3: Ledger can’t be trusted with your privacy. Their CEO said so:
“If, for you, your privacy is of the utmost importance, please do not use that product, for sure.”
SOURCE: Ledger CEO Pascal Gauthier, on video
Ledger’s CEO begged you to not use “Ledger Recover” if you value your privacy. “For sure.” But it’s baked into their closed source code, so you can’t prove their API isn’t sharing your keys even if you don’t use “Recover.” That’s one of the dangers of closed source code.
4: Ledger’s security can’t be trusted. They’ve been hacked:
Ledger wallet users face mounting home invasion and other scareware threats as hacker dumps private customer information online.
SOURCE: Cointelegraph, December 24th, 2020
Ledger can’t even keep their data secure. Don’t trust them with your coins.
5: Ledger’s code has been hacked.
Ledger exploit makes you spend Bitcoin instead of altcoins
“A vulnerability in Ledger’s hardware wallets enables hackers to prompt someone to spend Bitcoin instead of an altcoin.”
SOURCE: Decrypt.co
Ledger took a year to fix it, and they didn’t fix it until after it was reported in the media.
6: Ledger’s hardware has been hacked.
In this post, I’m going to discuss a vulnerability I discovered in Ledger hardware wallets. The vulnerability arose due to Ledger’s use of a custom architecture to work around many of the limitations of their Secure Element.
An attacker can exploit this vulnerability to compromise the device before the user receives it, or to steal private keys from the device physically or, in some scenarios, remotely.
I chose to publish this report in lieu of receiving a bounty from Ledger, mainly because Eric Larchevêque, Ledger’s CEO, made some comments on Reddit which were fraught with technical inaccuracy. As a result of this I became concerned that this vulnerability would not be properly explained to customers.
SOURCE: Saleem Rashid
Ledger’s bounty payments prevent those who’ve discovered vulnerabilities from reporting them so Ledger can lie and say they’ve never been hacked. More lies.
7: Ledger has been phished.
A Ledger employee just got phished. DeFi users lost over $600k
Ledger confirmed the attack was the result of a hacker compromising one of its employees via a phishing attack. After gaining access to Ledger’s internal systems, the hacker planted malicious software within the Ledger Connect Kit.
SOURCE: DLnews, December 14th, 2023
Ledger said an employee was phished, but under scrutiny, they changed their story, admitting it was a former employee who got phished.
8: Why did an ex-employee still have access to the codebase? Ledger won’t say:
How a Single Phishing Link Unleashed Chaos on Crypto: "Ledger has confirmed the attack began because “a former Ledger employee fell victim to a phishing attack.”
Source: Decrypt, December 14th, 2023
How many former Ledger employees still have access to their codebase? Ledger won’t say, not that we could trust any answer they’d give. Do they even know?
9: Ledger’s been hacked multiple times, and yet…
“The bombshell here is the explicit confirmation that Ledger themselves hold the master decryption key for all Ledger Recover users.”
SOURCE: @sethforprivacy
What could possibly go wrong, eh? Yikes.
10: Ledger Live tracks everything you do and the coins you have:
“Ledger Live is phoning out data on assets you hold in your hardware wallet the moment you access Ledger Live. It’s also sending out tons of other information about your computer and device.”
The app apparently transmits data to an external endpoint at “https://api.segment.io/v1/t”, identified as an outsourced data collection service.
SOURCE: BitcoinNews.com
Got a Ledger? Goodbye, privacy.
11: Ledger lies are even on the boxes for their hardware.
“WE ARE OPEN SOURCE”
SOURCE: Their own packaging.
The box for Ledger hardware running closed-source firmware says Open Source. That’s intentionally misleading if not outright fraud.
12: Ledger refuses to answer questions.
They delete questions in comments on their sub.
They shadowban users who ask them.
They scrub their website to remove claims they made for years.
The worst part is, this is only a partial list!
For example: Ledger was still promoting FTX after FTX collapsed.
I could go on and on. But if you want somebody else’s opinion, bitusher is one of the most respected Bitcoin redditors. Here’s what he had to say about Ledger.
Ledger’s word can’t be trusted.
Ledger’s code can’t be trusted.
Ledger’s management can’t be trusted.
Ledger can’t be trusted.
