Ledger

Our assessment

Ledger publishes firmware repositories, a security research programme and reachable technical documentation — most of what our rubric asks for. The part it does not publish is the part its architecture depends on most: BOLOS, the operating system running inside the secure element, is closed source.

A different bet on where trust should sit

Ledger drives the device display directly from the secure element, so the screen showing what you are about to sign sits inside the protected boundary rather than outside it. That is a real security property, and it is the reason the company gives for keeping the operating system closed. Whether you accept the trade is the single decision that separates this device from Trezor.

What is published

Wallet applications and much of the surrounding firmware are in public repositories under the vendor organisation, and Ledger Donjon publishes security research including attacks on its own products and on competitors. Security documentation and specification pages are reachable without an account. On our openness indicators the only consistent failure is a legal page at a conventional address.

Reputation and the 2020 data breach

The 2020 customer database leak exposed names and physical addresses of buyers and produced years of targeted phishing and physical threats. It was a marketing-database failure rather than a device failure, and it remains the most consequential thing that has happened to a hardware wallet company's customers. Anyone buying should assume their purchase details may be handled by a third party.

Who it suits

Ledger fits buyers who prioritise broad asset support, a mature ecosystem and secure-element-driven display verification, and who accept a closed operating system in exchange. Buyers whose requirement is that every line of code be auditable should choose Trezor, BitBox or Foundation Passport.