# Ledger Flex custody score: 49% | TradingAgentStack

> Ledger Flex by Ledger: custody score 49% from sourced facts on supply chain, key protection, signing, customer data and incidents. Checked 2026-11-05.

Canonical: https://tradingagentstack.com/custody/ledger/

1. [Home](https://tradingagentstack.com/)

2. [Custody](https://tradingagentstack.com/custody/)

3. Ledger Flex

# Ledger Flex: custody score 49%

Ledger · Multi-asset · checked 2026-11-05. 47 of 85 points from sourced facts. User losses in the last 12 months: capped at 49%

**Capped at 49%:** users lost funds in the last 12 months.

[Official store (shop.ledger.com) →](https://shop.ledger.com/)

## Score, input by input

| Input | What we found | Points | Source |
| --- | --- | --- | --- |
| Supply chain and authenticity Genuine-device check | In the app: Genuine Check in Ledger Wallet; Ledger says it can't detect every physical modification. | 10/10 | [source](https://www.ledger.com/academy/topics/ledgersolutions/best-practices-to-securely-buy-ledger-signer) |
| Supply chain and authenticity Official reseller list | Published: Official reseller list on shop.ledger.com; as of Nov 5, 2026 it shows CryptoBilis (Indonesia) as "Sales temporarily paused". | 5/5 | [source](https://shop.ledger.com/pages/resellers) |
| Supply chain and authenticity Tamper evidence | None found: No tamper-evidence feature: Ledger relies on Genuine Check, which the CryptoBilis implants (added inside the case) got past. | 0/5 | [source](https://therecord.media/ledger-cryptocurrency-wallet-implant-theft) |
| Supply chain and authenticity Response to reseller incidents | After losses: Halted CryptoBilis on October 9, 2026, after users reported drained wallets. | 2/5 | [source](https://therecord.media/ledger-cryptocurrency-wallet-implant-theft) |
| Key protection Secure element | Certified (EAL): CC EAL6+ secure element. | 6/6 | [source](https://cryptoslate.com/crypto-wallets/ledger-flex-review/) |
| Key protection Open firmware | Partly closed: Apps and Ledger Wallet are public; the low-level secure-element OS is closed (chip-vendor NDAs). | 4/9 | [source](https://www.ledger.com/ru/academy/topics/ledgersolutions/is-ledger-open-source) |
| Signing safety Own screen to check what you sign | Yes: E Ink touchscreen with Clear Signing and Transaction Check. | 15/15 | [source](https://cryptoslate.com/crypto-wallets/ledger-flex-review/) |
| Customer data exposure (36 months) Customer data | Partner breach: Jan 2026: order data accessed at Global-e, Ledger's e-commerce partner. | 5/15 | [source](https://www.theblock.co/post/384275/ledger-customers-data-leak-payment-processor) |
| Incident record (24 months) Security incidents | User losses: Oct 2026: devices sold through authorized reseller CryptoBilis carried implants that stole recovery phrases; press and on-chain estimates of losses run from about $72M to $100M. | 0/15 | [source](https://therecord.media/ledger-cryptocurrency-wallet-implant-theft) |

## Incidents

- **2026-10-12** Users report implanted devices bought outside CryptoBilis (MediaMarkt Germany, Singapore airport); not confirmed by Ledger. [source](https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/amp/)

- **2026-10-09** Implants in devices sold by authorized reseller CryptoBilis steal recovery phrases; wallets drained. [source](https://therecord.media/ledger-cryptocurrency-wallet-implant-theft)

- **2026-01-05** Order data accessed at e-commerce partner Global-e. [source](https://www.theblock.co/post/384275/ledger-customers-data-leak-payment-processor)

## Where to buy safely

- Buy from the maker: [shop.ledger.com](https://shop.ledger.com/).

- Resellers: Official reseller list on shop.ledger.com; as of Nov 5, 2026 it shows CryptoBilis (Indonesia) as "Sales temporarily paused". [source](https://shop.ledger.com/pages/resellers) Its list names 133 shops in 45 countries (copied 2026-11-05); paste any shop into the [reseller check](https://tradingagentstack.com/custody/#reseller-check).

- Revoked: CryptoBilis (Ledger (sales halted Oct 9, 2026), Trezor (removed Oct 9, 2026) and OneKey (authorization ended Oct 12, 2026)). [source](https://therecord.media/ledger-cryptocurrency-wallet-implant-theft)

- On arrival: check the packaging, run the genuine-device check, and reject any device that already has a PIN or recovery phrase set.

Official links, known fakes and the full incident list: [TAS Check: Ledger](https://tradingagentstack.com/check/ledger-live/).

## Keep it away from your bots

A hardware wallet is the vault. Don't connect it to a trading bot, an API key or an agent wallet: give the bot a separate trading float and sweep profits back to the vault's address. [How to split vault, float and sweeps](https://tradingagentstack.com/custody/#tiers). [Set up Ledger Flex as cold storage, step by step](https://tradingagentstack.com/cold-storage/).

## Questions

### Is Ledger Flex safe?

Ledger Flex scores 49% on our custody score (47 of 85 points from sourced facts, checked 2026-11-05). It is capped at 49% because users lost funds in the last 12 months. Weakest point: Oct 2026: devices sold through authorized reseller CryptoBilis carried implants that stole recovery phrases; press and on-chain estimates of losses run from about $72M to $100M.

### Has Ledger had a security incident?

Oct 2026: devices sold through authorized reseller CryptoBilis carried implants that stole recovery phrases; press and on-chain estimates of losses run from about $72M to $100M.

### Where should I buy Ledger Flex?

From the maker's store (shop.ledger.com). Resellers: Official reseller list on shop.ledger.com; as of Nov 5, 2026 it shows CryptoBilis (Indonesia) as "Sales temporarily paused". On arrival, run the genuine-device check and reject any device that already has a PIN or recovery phrase set.

## Other hardware wallets, scored
[OneKey Pro: 94%](https://tradingagentstack.com/custody/onekey/)[BitBox02 Nova: 89%](https://tradingagentstack.com/custody/bitbox/)[Blockstream Jade Plus: 79%](https://tradingagentstack.com/custody/blockstream-jade/)[Trezor Safe 5: 78%](https://tradingagentstack.com/custody/trezor/)[CoolWallet Pro: 72%](https://tradingagentstack.com/custody/coolwallet/)[Foundation Passport Prime: 66%](https://tradingagentstack.com/custody/foundation-passport/)[Tangem Wallet: 66%](https://tradingagentstack.com/custody/tangem/)[Keystone 3 Pro: 54%](https://tradingagentstack.com/custody/keystone/)[Coldcard Q: 49%](https://tradingagentstack.com/custody/coldcard/)

[All hardware wallets, scored](https://tradingagentstack.com/custody/) · [Is this seller authorized?](https://tradingagentstack.com/custody/#reseller-check) · [How we score](https://tradingagentstack.com/custody/#method)

## For agents

- [When to use this site, and the page index](https://tradingagentstack.com/llms.txt)
- [Sitemap](https://tradingagentstack.com/sitemap.xml)
- [Contact](https://tradingagentstack.com/contact/)
- [MCP server](https://tradingagentstack.com/mcp/)
- [MCP discovery](https://tradingagentstack.com/.well-known/mcp)