Is Ledger Live (now Ledger Wallet) safe to connect?
Self-custody wallet · Bitcoin, Ethereum, XRP, Other chains supported by Ledger devices. Checked 2026-10-26; every line links its source.
Worst case: Ledger Wallet (formerly Ledger Live) is self-custody, so no one can freeze your coins, but anyone who gets your 24 words can empty every account they back up, and that cannot be reversed. Fake 'Ledger Live' apps (Mac App Store, about $9.5M taken in April 2026) and phishing that uses leaked Ledger customer data (2020, January 2026) are built to get those 24 words. Signing a malicious transaction, as in the December 2023 Connect Kit attack, can also drain a wallet.
Safe setup in 3 steps
- Download Ledger Wallet (formerly Ledger Live) only through ledger.com: desktop builds come from download.live.ledger.com, and the mobile apps are App Store id1361671700 (seller Ledger SAS) and Google Play com.ledger.live. Ledger's phishing page says fake apps show an 'error' and then ask for your phrase.
- Never type your 24-word recovery phrase into a computer, phone, website or app; enter it only on the Ledger device itself. Ledger and its support will never ask for it, so treat any email, letter, call or 'Global-e'/'security' message that does as a scam.
- Check every transaction on the device screen before approving, reject any you did not start, and prefer clear signing over blind signing, as Ledger advised after the Connect Kit attack.
What it can do with your money
| Who holds the keys | You hold the keys Self-custody. Ledger Wallet (formerly Ledger Live) is the companion app; the private keys stay on the Ledger hardware device, 'keeping your private keys offline, far from hackers' reach'. Ledger says it will never ask for your 24-word recovery phrase or PIN. source |
|---|---|
| Can funds be sent out to any address? | Yes. You approve every transaction on the device yourself, to any address. Anyone who gets your 24-word phrase can do the same from another device, and nobody can reverse it. source |
Official links
- Website:
ledger.com - X:
@Ledger - GitHub:
github.com/LedgerHQ - App:
https://apps.apple.com/app/id1361671700 - App:
https://play.google.com/store/apps/details?id=com.ledger.live
Where we confirmed these
Known fakes
'Ledger Live' macOS app on Apple's App Store, publisher 'Leva Heal Limited' (removed by Apple)· 2026-04-14 source'Ledger Live Web3' app on the Microsoft Store (removed 2023-11-05)· 2023-11-08 sourcehttps://gknkargo.com/zxc/app.zip· 2025-05-22 sourcehttp://138.68.93.230/Ledger-Live.dmg· 2025-05-22 sourcehttp://138.68.93.230/ledgeras· 2025-05-22 sourceledger.com-a42-encryption-m6-email.rg37-s8-smtp.cloud· source
Incidents
| Date | What happened | Amount | Outcome | Source |
|---|---|---|---|---|
| 2026-04-14 | Reported date: a fake 'Ledger Live' macOS app published on Apple's App Store by 'Leva Heal Limited' (not Ledger) stole crypto from about 50 users; three victims lost funds between 2026-04-08 and 2026-04-11 (third-party impersonation, not a breach of Ledger). | ~$9.5M (about 50 victims, per BleepingComputer) | Apple removed the app 'for malicious bait-and-switch functionality' and terminated the developer account. No reimbursement reported. | source |
| 2026-01-05 | Global-e, Ledger's e-commerce partner (merchant of record for some ledger.com orders), told Ledger customers that order data in its systems was accessed without authorization: names, contact details and order details (products, prices). Ledger said its own platform, hardware and software were not breached and that payment data, 24-word phrases and balances were not affected. Scam emails posing as Global-e followed. | Customers notified by email from 2026-01-05; number affected not disclosed. No loss of funds reported. | source | |
| 2025-05-22 | Moonlock (MacPaw) reported four active macOS malware campaigns (Odyssey, AMOS and others) that swap the real Ledger Live app for a fake one showing a fake alert to get the 24-word phrase, then send it to the attackers (third-party report). | Security warning; Ledger users told to download only from ledger.com (TechRadar) | source | |
| 2023-12-14 | Ledger Connect Kit supply-chain attack: a former Ledger employee was phished and their npm account used to publish malicious Connect Kit versions 1.1.5-1.1.7 (first at 08:49 UTC). Dapps that loaded the library (e.g. SushiSwap, Revoke.cash) showed a drainer that tricked users into signing malicious transactions. A fixed version was out within 40 minutes of Ledger being alerted, but CDN caching kept the bad file live for about five hours in total. Ledger says the attacker never had access to its infrastructure, code repository or the dapps themselves. | ~$600K (Ledger estimate reported by Cointelegraph; The Block reported over $500K) | Tether froze the attacker's USDT at 13:55 UTC on Ledger's request and WalletConnect disabled the attacker's project. Ledger committed to make victims whole by the end of February 2024 and to end blind signing. | source |
| 2023-11-05 | A fake 'Ledger Live Web3' app on the Microsoft Store drained users' wallets; ZachXBT raised the alarm on 2023-11-05 (third-party impersonation, not a breach of Ledger). | at least $768,000 | Microsoft removed the app the same day | source |
| 2020-12-20 | A Ledger customer database was dumped publicly on RaidForums. INCIBE-CERT says it covered about 272,000 customers with email, name, phone number, postal address and product bought. Ledger tweeted the same day that it appeared to be its June 2020 e-commerce database. | Ledger warned users of phishing, said 'your assets are safe if your 24-word recovery phrase is', and says it has taken down more than 170 phishing sites since the original breach. | source | |
| 2020-06-25 | Ledger e-commerce and marketing database breach: a third party accessed it on 2020-06-25. A bug-bounty researcher reported the flaw on 2020-07-14 and Ledger fixed it that day, then disclosed the breach on 2020-07-29. About 1 million email addresses were exposed, and 9,500 customers also had their names, postal addresses, phone numbers or products ordered exposed. | Ledger notified France's CNIL on 2020-07-17 and emailed customers. Ledger says payment data, passwords and crypto funds were not affected, and the breach had 'no impact whatsoever' on hardware wallets or Ledger Live. The leaked data later fuelled phishing and physical-mail scams. | source |