# Is Ledger Live (now Ledger Wallet) safe to connect?

> Ledger Live (now Ledger Wallet): worst case for your money, official links, freeze and key risks, incidents and a 3-step safe setup. Sourced, checked...

Canonical: https://tradingagentstack.com/check/ledger-live/

1. [Home](https://tradingagentstack.com/)

2. [Check](https://tradingagentstack.com/check/)

3. Ledger Live (now Ledger Wallet)

# Is Ledger Live (now Ledger Wallet) safe to connect?

Self-custody wallet · Bitcoin, Ethereum, XRP, Other chains supported by Ledger devices. Checked 2026-10-26; every line links its source.

**Worst case:** Ledger Wallet (formerly Ledger Live) is self-custody, so no one can freeze your coins, but anyone who gets your 24 words can empty every account they back up, and that cannot be reversed. Fake 'Ledger Live' apps (Mac App Store, about $9.5M taken in April 2026) and phishing that uses leaked Ledger customer data (2020, January 2026) are built to get those 24 words. Signing a malicious transaction, as in the December 2023 Connect Kit attack, can also drain a wallet.

Already lost funds? [What to do if a bot or wallet is drained](https://tradingagentstack.com/trading-bot-drained-what-to-do/).

## Safe setup in 3 steps

1. Download Ledger Wallet (formerly Ledger Live) only through ledger.com: desktop builds come from download.live.ledger.com, and the mobile apps are App Store id1361671700 (seller Ledger SAS) and Google Play com.ledger.live. Ledger's phishing page says fake apps show an 'error' and then ask for your phrase.

2. Never type your 24-word recovery phrase into a computer, phone, website or app; enter it only on the Ledger device itself. Ledger and its support will never ask for it, so treat any email, letter, call or 'Global-e'/'security' message that does as a scam.

3. Check every transaction on the device screen before approving, reject any you did not start, and prefer clear signing over blind signing, as Ledger advised after the Connect Kit attack.

## What it can do with your money

| Who holds the keys | You hold the keys Self-custody. Ledger Wallet (formerly Ledger Live) is the companion app; the private keys stay on the Ledger hardware device, 'keeping your private keys offline, far from hackers' reach'. Ledger says it will never ask for your 24-word recovery phrase or PIN. [source](https://www.ledger.com/start) |
| --- | --- |
| Can funds be sent out to any address? | Yes. You approve every transaction on the device yourself, to any address. Anyone who gets your 24-word phrase can do the same from another device, and nobody can reverse it. [source](https://www.ledger.com/phishing-campaigns-status) |

## Official links

Each link below was confirmed from at least two independent places (the vendor's own pages plus another source). Anything else using this name is not on the list.

- Website: `ledger.com`

- X: `@Ledger`

- GitHub: `github.com/LedgerHQ`

- App: `https://apps.apple.com/app/id1361671700`

- App: `https://play.google.com/store/apps/details?id=com.ledger.live`

Where we confirmed these
- https://shop.ledger.com/pages/ledger-wallet-download (vendor download page, 'FORMERLY Ledger Live': links App Store id1361671700, Google Play com.ledger.live, and desktop builds at download.live.ledger.com/latest/win, /mac, /linux)

- https://www.ledger.com/phishing-campaigns-status (vendor phishing page: 'Ledger Wallet (formerly Ledger Live)'; official email domains @ledger.fr, @ledger.com, @ledgerwallet.com, @ledger.zendesk.com; social twitter.com/ledger, facebook.com/ledger, instagram.com/ledger; support at support.ledger.com; download only from ledger.com)

- https://apps.apple.com/app/id1361671700 ('Ledger Wallet™ Crypto Wallet', seller Ledger SAS, developer website https://www.ledger.com/ledger-live, privacy policy ledger.com, v4.25)

- https://play.google.com/store/apps/details?id=com.ledger.live&hl=en_GB ('Ledger Wallet™ Crypto Wallet', developer Ledger, developer website https://www.ledger.com, email support@ledger.com, 1M+ downloads, updated 2026-10-03)

- https://github.com/ledgerhq (GitHub org 'Ledger', verified domains www.ledger.com and ledger.fr; website https://www.ledger.com; profile links twitter.com/Ledger and twitter.com/Ledger_Support; hosts the ledger-live monorepo, whose README says to download production apps from https://download.live.ledger.com)

- https://www.ledger.com/our-communications-about-data-breach (vendor: official Twitter accounts @Ledger and @Ledger_Support; fake accounts exist on Twitter, Facebook, Telegram and WhatsApp)

### Known fakes

- `'Ledger Live' macOS app on Apple's App Store, publisher 'Leva Heal Limited' (removed by Apple)` · 2026-04-14 [source](https://bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto)

- `'Ledger Live Web3' app on the Microsoft Store (removed 2023-11-05)` · 2023-11-08 [source](https://blog.eset.ie/2023/11/08/fake-ledger-live-app-in-microsoft-store-steals-768000-in-crypto/)

- `https://gknkargo.com/zxc/app.zip` · 2025-05-22 [source](https://moonlock.com/anti-ledger-malware)

- `http://138.68.93.230/Ledger-Live.dmg` · 2025-05-22 [source](https://moonlock.com/anti-ledger-malware)

- `http://138.68.93.230/ledgeras` · 2025-05-22 [source](https://moonlock.com/anti-ledger-malware)

- `ledger.com-a42-encryption-m6-email.rg37-s8-smtp.cloud` · [source](https://www.ledger.com/phishing-campaigns-status)

## Incidents

Items marked "reported by users" are claims we could not confirm with the vendor or a security firm.

| Date | What happened | Amount | Outcome | Source |
| --- | --- | --- | --- | --- |
| 2026-04-14 | Reported date: a fake 'Ledger Live' macOS app published on Apple's App Store by 'Leva Heal Limited' (not Ledger) stole crypto from about 50 users; three victims lost funds between 2026-04-08 and 2026-04-11 (third-party impersonation, not a breach of Ledger). (third-party report) | ~$9.5M (about 50 victims, per BleepingComputer) | Apple removed the app 'for malicious bait-and-switch functionality' and terminated the developer account. No reimbursement reported. | [source](https://bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto) |
| 2026-01-05 | Global-e, Ledger's e-commerce partner (merchant of record for some ledger.com orders), told Ledger customers that order data in its systems was accessed without authorization: names, contact details and order details (products, prices). Ledger said its own platform, hardware and software were not breached and that payment data, 24-word phrases and balances were not affected. Scam emails posing as Global-e followed. |  | Customers notified by email from 2026-01-05; number affected not disclosed. No loss of funds reported. | [source](https://www.theblock.co/post/384275/ledger-customers-data-leak-payment-processor) |
| 2025-05-22 | Moonlock (MacPaw) reported four active macOS malware campaigns (Odyssey, AMOS and others) that swap the real Ledger Live app for a fake one showing a fake alert to get the 24-word phrase, then send it to the attackers (third-party report). (third-party report) |  | Security warning; Ledger users told to download only from ledger.com (TechRadar) | [source](https://moonlock.com/anti-ledger-malware) |
| 2023-12-14 | Ledger Connect Kit supply-chain attack: a former Ledger employee was phished and their npm account used to publish malicious Connect Kit versions 1.1.5-1.1.7 (first at 08:49 UTC). Dapps that loaded the library (e.g. SushiSwap, Revoke.cash) showed a drainer that tricked users into signing malicious transactions. A fixed version was out within 40 minutes of Ledger being alerted, but CDN caching kept the bad file live for about five hours in total. Ledger says the attacker never had access to its infrastructure, code repository or the dapps themselves. | ~$600K (Ledger estimate reported by Cointelegraph; The Block reported over $500K) | Tether froze the attacker's USDT at 13:55 UTC on Ledger's request and WalletConnect disabled the attacker's project. Ledger committed to make victims whole by the end of February 2024 and to end blind signing. | [source](https://ledger.com/blog/security-incident-report) |
| 2023-11-05 | A fake 'Ledger Live Web3' app on the Microsoft Store drained users' wallets; ZachXBT raised the alarm on 2023-11-05 (third-party impersonation, not a breach of Ledger). (third-party report) | at least $768,000 | Microsoft removed the app the same day | [source](https://blog.eset.ie/2023/11/08/fake-ledger-live-app-in-microsoft-store-steals-768000-in-crypto/) |
| 2020-12-20 | A Ledger customer database was dumped publicly on RaidForums. INCIBE-CERT says it covered about 272,000 customers with email, name, phone number, postal address and product bought. Ledger tweeted the same day that it appeared to be its June 2020 e-commerce database. |  | Ledger warned users of phishing, said 'your assets are safe if your 24-word recovery phrase is', and says it has taken down more than 170 phishing sites since the original breach. | [source](https://incibe.es/en/incibe-cert/publications/cybersecurity-highlights/published-database-property-ledger) |
| 2020-06-25 | Ledger e-commerce and marketing database breach: a third party accessed it on 2020-06-25. A bug-bounty researcher reported the flaw on 2020-07-14 and Ledger fixed it that day, then disclosed the breach on 2020-07-29. About 1 million email addresses were exposed, and 9,500 customers also had their names, postal addresses, phone numbers or products ordered exposed. |  | Ledger notified France's CNIL on 2020-07-17 and emailed customers. Ledger says payment data, passwords and crypto funds were not affected, and the breach had 'no impact whatsoever' on hardware wallets or Ledger Live. The leaked data later fuelled phishing and physical-mail scams. | [source](https://www.ledger.com/addressing-the-july-2020-e-commerce-and-marketing-data-breach) |

## Check a link

Got a link, @handle or repo that claims to be Ledger Live (now Ledger Wallet)? Paste it to see if it's on the official list.

Checking links inside Telegram? Send them to [@TASCheckBot](https://t.me/TASCheckBot), or add it to your group so anyone can type `/check`. Alerts on new drains and fakes: [@tradingAgentStk](https://x.com/tradingAgentStk).

## Get an alert for Ledger Live (now Ledger Wallet)

We email you if we add an incident, a freeze report, a known fake or a deadline for Ledger Live (now Ledger Wallet). Free; unsubscribe anytime.

## More checks: Wallets
[Phantom](https://tradingagentstack.com/check/phantom/)[MetaMask](https://tradingagentstack.com/check/metamask/)[Rabby Wallet](https://tradingagentstack.com/check/rabby/)[Trust Wallet](https://tradingagentstack.com/check/trust-wallet/)[Exodus](https://tradingagentstack.com/check/exodus/)[Backpack](https://tradingagentstack.com/check/backpack/)[Solflare](https://tradingagentstack.com/check/solflare/)[Coinbase Wallet](https://tradingagentstack.com/check/coinbase-wallet/)[Electrum](https://tradingagentstack.com/check/electrum/)[Keystone](https://tradingagentstack.com/check/keystone/)[Trezor Suite](https://tradingagentstack.com/check/trezor-suite/)[OKX Wallet](https://tradingagentstack.com/check/okx-wallet/)[Bitget Wallet](https://tradingagentstack.com/check/bitget-wallet/)

Something wrong or out of date? [Send a correction](https://tradingagentstack.com/submit/) with a link to the vendor's docs. Not financial advice. [How we check](https://tradingagentstack.com/check/#method).

## For agents

- [When to use this site, and the page index](https://tradingagentstack.com/llms.txt)
- [Sitemap](https://tradingagentstack.com/sitemap.xml)
- [Contact](https://tradingagentstack.com/contact/)
- [MCP server](https://tradingagentstack.com/mcp/)
- [MCP discovery](https://tradingagentstack.com/.well-known/mcp)