Ledger Flex: custody score 49%
Ledger · Multi-asset · checked 2026-11-05. 47 of 85 points from sourced facts. User losses in the last 12 months: capped at 49%
Capped at 49%: users lost funds in the last 12 months.
Official store (shop.ledger.com) →
Score, input by input
| Input | What we found | Points | Source |
|---|---|---|---|
| Supply chain and authenticity | In the app: Genuine Check in Ledger Wallet; Ledger says it can't detect every physical modification. | 10/10 | source |
| Supply chain and authenticity | Published: Official reseller list on shop.ledger.com; as of Nov 5, 2026 it shows CryptoBilis (Indonesia) as "Sales temporarily paused". | 5/5 | source |
| Supply chain and authenticity | None found: No tamper-evidence feature: Ledger relies on Genuine Check, which the CryptoBilis implants (added inside the case) got past. | 0/5 | source |
| Supply chain and authenticity | After losses: Halted CryptoBilis on October 9, 2026, after users reported drained wallets. | 2/5 | source |
| Key protection | Certified (EAL): CC EAL6+ secure element. | 6/6 | source |
| Key protection | Partly closed: Apps and Ledger Wallet are public; the low-level secure-element OS is closed (chip-vendor NDAs). | 4/9 | source |
| Signing safety | Yes: E Ink touchscreen with Clear Signing and Transaction Check. | 15/15 | source |
| Customer data exposure (36 months) | Partner breach: Jan 2026: order data accessed at Global-e, Ledger's e-commerce partner. | 5/15 | source |
| Incident record (24 months) | User losses: Oct 2026: devices sold through authorized reseller CryptoBilis carried implants that stole recovery phrases; press and on-chain estimates of losses run from about $72M to $100M. | 0/15 | source |
Incidents
- 2026-10-12 Users report implanted devices bought outside CryptoBilis (MediaMarkt Germany, Singapore airport); not confirmed by Ledger. source
- 2026-10-09 Implants in devices sold by authorized reseller CryptoBilis steal recovery phrases; wallets drained. source
- 2026-01-05 Order data accessed at e-commerce partner Global-e. source
Where to buy safely
- Buy from the maker: shop.ledger.com.
- Resellers: Official reseller list on shop.ledger.com; as of Nov 5, 2026 it shows CryptoBilis (Indonesia) as "Sales temporarily paused". source Its list names 133 shops in 45 countries (copied 2026-11-05); paste any shop into the reseller check.
- Revoked: CryptoBilis (Ledger (sales halted Oct 9, 2026), Trezor (removed Oct 9, 2026) and OneKey (authorization ended Oct 12, 2026)). source
- On arrival: check the packaging, run the genuine-device check, and reject any device that already has a PIN or recovery phrase set.
Official links, known fakes and the full incident list: TAS Check: Ledger.
Keep it away from your bots
A hardware wallet is the vault. Don't connect it to a trading bot, an API key or an agent wallet: give the bot a separate trading float and sweep profits back to the vault's address. How to split vault, float and sweeps. Set up Ledger Flex as cold storage, step by step.
Questions
Is Ledger Flex safe?
Ledger Flex scores 49% on our custody score (47 of 85 points from sourced facts, checked 2026-11-05). It is capped at 49% because users lost funds in the last 12 months. Weakest point: Oct 2026: devices sold through authorized reseller CryptoBilis carried implants that stole recovery phrases; press and on-chain estimates of losses run from about $72M to $100M.
Has Ledger had a security incident?
Oct 2026: devices sold through authorized reseller CryptoBilis carried implants that stole recovery phrases; press and on-chain estimates of losses run from about $72M to $100M.
Where should I buy Ledger Flex?
From the maker's store (shop.ledger.com). Resellers: Official reseller list on shop.ledger.com; as of Nov 5, 2026 it shows CryptoBilis (Indonesia) as "Sales temporarily paused". On arrival, run the genuine-device check and reject any device that already has a PIN or recovery phrase set.
Other hardware wallets, scored
All hardware wallets, scored · Is this seller authorized? · How we score