Ledger and Trezor both keep your keys offline, and both now use a certified secure element chip. The real differences are in openness and track record. Trezor publishes its firmware and hardware designs; Ledger keeps the low-level secure element code closed and sells an optional, ID-verified seed backup service (Ledger Recover). Neither company’s devices have a confirmed remote key-extraction hack, but both have leaked customer data, Ledger had a software supply-chain exploit in December 2023, and in October 2026 tampered Ledger devices sold by a Southeast Asian reseller were used to drain wallets. As of 14 October 2026, list prices run from $59 (Trezor Safe 3) to $399 (Ledger Stax). Which one fits depends on how you use crypto, not on a single winner.
If you are choosing between Ledger and Trezor, most comparisons hand you a score out of 10 and a “winner”, often with a buy link next to it. That skips what you actually need to know: how each device protects your keys, what has gone wrong at each company and when, and which design suits the way you hold crypto. This guide covers the two security models, a dated incident table for both brands (including the October 2026 reseller implant case), current models and list prices from the official shops, and a fit-by-user table instead of a verdict. There are no affiliate links on this page.
Ledger vs Trezor: the short answer
Neither Trezor nor Ledger is simply “more secure”. Ledger runs everything on a closed, certified secure element chip and asks you to trust code you can mostly, but not fully, inspect. Trezor makes its firmware and hardware designs public and, since the Safe series, adds a certified secure element as well. Ledger offers more connectivity (Bluetooth and NFC on most models) and an optional paid seed backup service. Trezor offers SLIP-39 multi-share backups on every current model. Both companies have leaked customer contact data, which feeds phishing, and in practice phishing and bad purchase channels have cost users far more than any attack on the chips.
| Ledger | Trezor | |
|---|---|---|
| Company | Ledger SAS, France | SatoshiLabs, Czech Republic |
| Current models (14 Oct 2026) | Nano S Plus, Nano X, Nano Gen5, Flex, Stax | Safe 3, Safe 5, Safe 7 |
| List price range (USD, official shops, 14 Oct 2026) | $69 to $399 | $59 to $249 |
| Secure element | On every model: CC EAL5+ (Nano X) or EAL6+ (all others) | On every current model: EAL6+; Safe 7 adds the TROPIC01 chip |
| Code openness | Ledger says about 95% open or reviewable; secure element code closed under chipmaker NDA | Firmware public on GitHub (GPL-3.0); Trezor markets “100% open-source code & design” |
| Backup options | 24-word phrase, optional passphrase, optional paid Ledger Recover | 12, 20 or 24 words, multi-share (SLIP-39) backup, optional passphrase |
| Wireless | Bluetooth on Nano X, Gen5, Flex, Stax; NFC on Gen5, Flex, Stax | Bluetooth on Safe 7 only |
| Biggest incidents | 2020 customer-data leak; Dec 2023 Connect Kit exploit; Oct 2026 reseller implant drains | Jan 2024 support-portal leak; Aug to Sep 2026 shipping and email vendor breaches |
Sources: shop.ledger.com product pages and comparison page, trezor.io/compare and product pages, all checked 14 October 2026. Incident sources are in the tables below.
The two companies at a glance
Ledger
Ledger is a French company. Its homepage claims more than 8 million devices (“signers”) sold and “20%+” of global crypto secured; those are company claims that this site has not verified. Ledger’s companion app is now called Ledger Wallet (formerly Ledger Live). Its range splits into touchscreen devices (Stax, Flex, Nano Gen5) and button devices (Nano X, Nano S Plus).
Trezor
Trezor is made by SatoshiLabs in the Czech Republic. Its current range is the Safe 3 (buttons), Safe 5 (colour touchscreen) and Safe 7 (larger touchscreen, Bluetooth and wireless charging). The older Model One and Model T no longer appear on Trezor’s comparison page (checked 14 October 2026), although several ranking pages still compare them.
How each security model works
Every hardware wallet does the same basic job: it creates your keys, keeps them on the device, and signs transactions there, so your computer or phone never sees the private key. Where Ledger and Trezor differ is which chip does what, and how much of the code you can read.
Secure element vs open source
A secure element is a tamper-resistant chip of the kind used in bank cards and passports, designed to resist physical probing, glitching and side-channel attacks. Its certification level (Common Criteria EAL5+ or EAL6+) describes how hard it was evaluated against such attacks, not whether the device as a whole is safe.
- Ledger puts the whole job on the secure element. In its own comparison (updated 17 April 2026), Ledger says a single secure element handles key storage, its operating system, transaction parsing, the screen and signing. The Nano Gen5 product page names the chip as an ST33K1M5, certified CC EAL6+.
- Trezor uses two chips. The secure element protects secrets, while a general-purpose microcontroller runs the open firmware. Ledger’s comparison argues this split means a compromised microcontroller could in theory show one transaction and sign another. That is a competitor’s argument, and Ledger also states that no attack has confirmed real-world key extraction from either company’s current devices. Trezor’s Safe 7 page describes a “fully auditable” TROPIC01 secure element working alongside an EAL6+ Optiga secure element and an STM32U5 microcontroller.
The trade-off is between two kinds of trust. With Ledger, you rely on a hardened chip and a company whose lowest-level code you cannot inspect. With Trezor, anyone can audit the code, but more of the work happens on a general-purpose chip, which has been the target of past physical attacks (see below).
Is Ledger open source?
Mostly, not fully. Ledger’s own post on the subject (published 18 July 2024) says its software is “95% OpenSource and/or available for you to review”, including the Ledger Wallet app, the Secure SDK, embedded apps and the entry points of Ledger Recover, all on GitHub under LedgerHQ. What stays closed is the low-level code that talks directly to the secure element and the circuit design: Ledger says its agreement with chipmaker STMicroelectronics prevents it from publishing that code. Ledger’s explanation does not say how the 95% figure is calculated.
Trezor’s firmware sits in a public monorepo (github.com/trezor/trezor-firmware, GPL-3.0 licence, checked 14 October 2026), and its compare page marks all three Safe models as open source. Open code lets independent researchers check what the device does. It does not, by itself, prove the device you received runs that code, which is why both companies check firmware signatures at boot.
Ledger Recover (May 2023) and what it changed
In mid-May 2023 Ledger announced Ledger Recover, an opt-in service that backs up your recovery phrase with outside custodians and requires identity (KYC) verification. The reaction was fierce. Critics objected that Ledger had previously said private keys would never leave the device, worried about custodian hacks, KYC data leaks and law-enforcement access, and noted that the code could not be audited. On 23 May 2023 CEO Pascal Gauthier said Ledger would not release the feature before releasing its code, and would speed up open-sourcing core parts of its operating system (CoinDesk, 23 May 2023).
How it works, by Ledger’s description (July 2023): the secure element splits your phrase into three shares using a variant of Shamir secret sharing, any two of which can rebuild it. The shares go to three providers: Coincover (UK), EscrowTech (US) and Ledger (France). Ledger’s passphrase support article (updated 20 July 2026) describes Recover as an optional subscription-only service and says it never has access to your passphrase.
What changed for you: if you never subscribe, nothing leaves the device. But Recover showed that Ledger’s firmware can, with your PIN approval, export seed-derived data, and it put identity checks next to self-custody for the first time. If that is a deal-breaker, it is a legitimate reason to prefer Trezor; if you are more afraid of losing your paper backup than of a custodian breach, it is a feature Trezor does not offer.
Passphrase and Shamir (SLIP-39) support
- Passphrase (“25th word”): both support it. Ledger’s support article lets you attach a passphrase to a second PIN or enter it temporarily each session; the passphrase itself is never stored on the device. Trezor’s compare page lists passphrase support on the Safe 3, 5 and 7. A passphrase is also the main defence against the physical seed-extraction attacks described below.
- Multi-share backup: Trezor lists 12, 20 and 24-word backups and “Advanced Multi-share Backup” on all three Safe models. The 20-word option is SLIP-39 (Shamir), the standard SatoshiLabs published, which lets you split a backup so that, for example, any 2 of 3 shares restore the wallet. Ledger’s shop and support pages checked for this article list a 24-word phrase plus optional Ledger Recover, and no SLIP-39 option.
The seed phrase guide explains how BIP-39 phrases, passphrases and SLIP-39 shares work and why splitting a normal 12-word phrase by hand is a bad idea.
Has Ledger or Trezor ever been hacked?
It depends what you mean by “hacked”. No incident in the record below involves an attacker remotely pulling keys out of a genuine, untampered device. What has happened falls into three groups: customer data leaks that fuel phishing, software supply-chain attacks, and physical attacks on devices in an attacker’s hands.
Ledger incident timeline
| Date | What happened | Impact on funds |
|---|---|---|
| 25 June 2020 (access); disclosed July 2020 | Unauthorised access to Ledger’s e-commerce and marketing database. Ledger says about 1 million email addresses were exposed, and for 9,500 customers also names, postal addresses and phone numbers. (CoinDesk’s January 2026 recap cites about 270,000 customers, reflecting later reporting.) | Ledger says no payment data, credentials or funds were affected. The data has fuelled phishing ever since. |
| 14 December 2023 | Ledger Connect Kit exploit. A former employee was phished, and the attacker used their still-active NPM access to publish malicious versions 1.1.5 to 1.1.7 of the Connect Kit library, which injected a wallet drainer into dapps that used it. Ledger says the malicious file was live for about five hours and active draining lasted under two hours. | Users of affected dapps who signed transactions lost funds; CoinDesk puts the total at nearly $500,000. Hardware devices themselves were not compromised. |
| Early January 2026 (reported 5 January) | Breach at Global-e, Ledger’s merchant of record for some Ledger.com orders. Names and contact details exposed; number not disclosed. | Ledger says its own platform, hardware and software were not breached and payment data was not involved. |
| 9 to 13 October 2026 | Wallets set up on Ledger devices sold by CryptoBilis, a reseller operating in Indonesia, Malaysia and the Philippines, were drained on 9 October. On 10 October Ledger confirmed an “unauthorized hardware implant” in an affected device. Ledger’s Donjon team found the implant reads the recovery phrase from the screen during setup and sends it out over LTE, without altering the secure chip or operating system. | On-chain researchers estimate $86 million to $93 million taken from more than 300 wallets; Ledger has not confirmed a loss figure. Ledger says its own systems and direct sales channels were unaffected. |
Sources: Ledger’s July 2020 breach post; Ledger’s Connect Kit incident report (20 December 2023); CoinDesk (5 January 2026 and 12 October 2026); Decrypt (13 October 2026). Checked 14 October 2026.
Trezor incident timeline
| Date | What happened | Impact on funds |
|---|---|---|
| May 2022 | Trezor warned about counterfeit Model T devices sold by an unauthorised seller on a Russian marketplace (per Decrypt). | Risk limited to buyers of the fakes. |
| 17 January 2024 | Unauthorised access to Trezor’s third-party support ticketing portal. Names or nicknames and email addresses of up to 66,000 people who contacted support since December 2021 may have been exposed; the attacker emailed 41 of them asking for recovery seeds. | Trezor says no funds were compromised and devices were not affected; postal addresses and phone numbers were not exposed. |
| August to September 2026 | Shipping partner ShipMonk exposed customer names, phone numbers and home addresses (from 10 August); Trezor’s September update put the total at 80,689 customers (per Decrypt). On 9 September Trezor confirmed its third-party email provider was breached and used to send a fake “STM32 Entropy Vulnerability” alert. | Trezor says keys and wallet backups were not affected. Customers reported scam calls and letters. |
| 13 October 2026 | After the Ledger implant case, Trezor said it would end authorisation for part of its reseller network from 1 January 2027 and tighten rules for the rest. It said there is no evidence its devices were tampered with and that CryptoBilis was already off its seller list. | Preventive step; no Trezor losses reported. |
Sources: Trezor’s January 2024 security update; Decrypt (13 October 2026); Yahoo Tech (9 September 2026). Checked 14 October 2026.
Physical attacks published by researchers
These attacks need the device in the attacker’s hands. They matter if your wallet could be stolen, seized or intercepted.
| Published | Researcher | Target | Finding |
|---|---|---|---|
| 1 July 2019 (disclosed to Trezor December 2018) | Ledger Donjon (Ledger’s own security team) | Trezor One, Trezor Model T and clones such as KeepKey | Seed extracted in about five minutes with a roughly $100 board; Ledger said it could not be patched in firmware and recommended a long passphrase. |
| 31 January 2020 (disclosed to Trezor 30 October 2019) | Kraken Security Labs | Trezor One and Model T | Voltage glitching extracted the encrypted seed in about 15 minutes of physical access, after which the PIN could be brute-forced. Kraken said the flaw was in the microcontroller hardware and advised a BIP-39 passphrase. |
| Undated on the publisher’s page | Unciphered | A OneKey wallet (not Ledger or Trezor) | Intercepted unencrypted traffic between the processor and the secure element with an FPGA. Relevant as a reminder that adding a secure element only helps if the link to it is protected. |
Sources: Ledger Donjon blog (July 2019); Kraken Security Labs (January 2020); Unciphered’s site. Checked 14 October 2026.
Both published Trezor attacks hit models without a secure element, which are no longer on Trezor’s comparison page. Every current Safe model lists an EAL6+ secure element. This article found no published, independent key-extraction attack on a current Safe or Ledger model; that is an absence of public findings, not proof that none is possible. Note too that the 2019 Donjon work came from Trezor’s direct competitor.
Phishing letters and fake “updates” (February and August 2026)
Leaked addresses have a direct consequence: paper mail. CCN reported on 16 February 2026 that Ledger and Trezor customers were receiving printed letters demanding a “mandatory Authentication Check” or “Transaction Check”, with QR codes leading to lookalike sites that ask for the recovery phrase, and deadlines up to 15 February 2026. Switzerland’s NCSC warned on 18 August 2026 about a similar wave claiming a “quantum resistance” update. No genuine hardware wallet maker will ever ask for your recovery phrase by letter, email, phone or website.
The October 2026 reseller implant: what it means for buyers
The CryptoBilis case is the most important new fact for anyone buying a hardware wallet right now, and it is missing from the ranking pages reviewed for this article. The implant did not break Ledger’s secure element. It sat beside it, read the 24 words off the screen during setup, and sent them out over a mobile connection. Because the secure chip and operating system were untouched, the device looked and worked normally (Decrypt, 13 October 2026), and The Defiant reported Ledger as saying its Genuine Check “cannot exclude tampering that leaves the secure chip intact”.
Ledger’s guidance (as reported by CoinDesk, 12 October 2026): if you bought from CryptoBilis, do not set the device up; if you already have, move funds to a new recovery phrase generated on a device bought directly from Ledger, contact official Ledger support and report it to local police. Trezor’s response was to cut part of its reseller network from 1 January 2027.
The lesson applies to both brands. A device’s security starts with where it comes from. Buy from the manufacturer’s own shop, check the packaging, and never use a device that arrives with a recovery phrase already printed or set up.
Current models and list prices (14 October 2026)
| Model | List price (USD) | Screen and input | Connectivity | Secure element |
|---|---|---|---|---|
| Trezor Safe 3 | $59 | 0.96″ monochrome, two buttons | USB-C | EAL6+ |
| Ledger Nano S Plus | $69 | 1.1″ monochrome OLED, two buttons | USB only | CC EAL6+ |
| Ledger Nano X | $99 | 1.1″ monochrome OLED, two buttons | USB, Bluetooth | CC EAL5+ |
| Trezor Safe 5 | $129 | 1.54″ colour touchscreen | USB-C | EAL6+ |
| Ledger Nano Gen5 | $179 | 2.8″ E Ink touchscreen | USB-C, Bluetooth, NFC | CC EAL6+ (ST33K1M5) |
| Trezor Safe 7 | $249 | 2.5″ colour touchscreen | USB-C, Bluetooth, Qi2 charging | EAL6+ Optiga plus TROPIC01 |
| Ledger Flex | $249 | 2.8″ E Ink touchscreen | USB-C, Bluetooth, NFC | CC EAL6+ |
| Ledger Stax | $399 | 3.7″ curved E Ink touchscreen | USB-C, Bluetooth, NFC, Qi charging | CC EAL6+ |
Prices are the US list prices shown on shop.ledger.com and trezor.io on 14 October 2026, before tax and shipping. Prices change often and differ by region; ranking pages quote the Safe 3 at $79 or $99 and the Nano S Plus at $59, which no longer matches the official shops. Specs from each maker’s comparison and product pages, same date.
Trezor also claims the Safe 7 is the first hardware wallet to use post-quantum signatures (SLH-DSA-128) to verify its bootloader and firmware. That is a vendor claim about firmware integrity, not about your coins, which still depend on each blockchain’s own signature scheme.
What happens if Trezor or Ledger goes out of business?
Your coins are recorded on the blockchain, not inside the device. If either company disappeared, you could restore your wallet from your recovery phrase in any other wallet that supports the same standard (BIP-39 for a normal phrase, SLIP-39 for Trezor multi-share backups). The weak point is not the company but your backup: lose the phrase and the device together, and nobody can restore the wallet. Ledger Recover users would also depend on its three custodians still operating.
Is Ledger safe? Is Trezor safe? Can you lose crypto on one?
No hardware wallet makes your crypto safe on its own, and you can lose funds with either. Based on the record above, the ways people actually lose money are, in order of how often they appear in the incidents reviewed:
- Giving away the recovery phrase to a phishing email, letter, fake support agent or lookalike site, often aimed at people whose details leaked in a breach.
- Using a tampered device from an unofficial or compromised reseller, as in October 2026.
- Signing a malicious transaction, as with the 2023 Connect Kit drainer. A hardware wallet signs what you approve; it cannot judge intent.
- Physical theft without a passphrase, for older Trezor models in particular.
- Losing the backup, which no company can fix for you.
The same risks apply to software wallets, plus the risk of malware on an internet-connected device. If you use a hardware wallet with MetaMask or Trust Wallet, the MetaMask safety review and Trust Wallet safety review cover the software side.
Which to buy: fit by user
This is not a ranking. Each row matches a type of user to the design trade-off that suits them, using the evidence above. Prices are list prices as of 14 October 2026.
| If you… | Lean towards | Why | Watch out for |
|---|---|---|---|
| Want to verify the code yourself, or care most about open-source | Trezor (any Safe model) | Public firmware under GPL-3.0; Safe 7 adds an auditable TROPIC01 chip | Two-chip design; past physical attacks on older models |
| Hold mostly Bitcoin, want a basic cold-storage device for little money | Trezor Safe 3 ($59) or Ledger Nano S Plus ($69) | Both have a certified secure element and no wireless radio | Small screens make long addresses harder to check |
| Want to split your backup across places or people | Trezor | SLIP-39 multi-share backup on every current model | Shares must be stored as carefully as a phrase; check your recovery wallet supports SLIP-39 |
| Fear losing your backup more than a custodian breach | Ledger, with Ledger Recover | Paid, ID-verified 2-of-3 share backup with three companies | KYC data and third-party custodians become part of your risk; subscription cost |
| Mostly use a phone and want wireless signing | Ledger Nano X, Nano Gen5, Flex or Stax; or Trezor Safe 7 | Bluetooth (and NFC on newer Ledgers) for mobile use | Wireless adds attack surface; Bluetooth can be turned off on the Safe 7 |
| Use DeFi and many tokens across chains, often | Ledger touchscreen models (Gen5, Flex, Stax) | Ledger says it pushes clear signing over blind signing after the 2023 exploit; larger screens show more transaction detail | Higher price ($179 to $399); you still have to read what you sign |
| Live where you can only buy through local resellers | Either, bought from the official shop if it ships to you | The October 2026 implant came through a reseller, not Ledger’s own channel | If you must use a reseller, confirm it is listed on the maker’s site and set up a fresh phrase on the device yourself |
| Worry about physical theft or seizure | Either current model, with a passphrase | A passphrase is never stored on the device; it is the mitigation the Kraken and Donjon researchers recommended | Forget the passphrase and your phrase alone will not restore those funds |
If you are a business choosing custody for company or client funds, a single consumer device is rarely the right tool. The institutional custody guide compares MPC, multisig and qualified custodians, and the Wallet & Custody Providers section collects related reviews.
What this means for you
As of 14 October 2026, the choice between Ledger and Trezor is a choice between two reasonable security models, not between a safe and an unsafe device. Ledger gives you a closed, certified chip, wireless options and an optional custodial backup, and its record includes a 2020 data leak, a 2023 software supply-chain exploit and the October 2026 reseller implant drains. Trezor gives you open code and multi-share backups, and its record includes physical attacks on discontinued models and repeated vendor data breaches in 2024 and 2026. Whichever you choose, the decisions that protect you most are the same: buy from the official shop, generate your own recovery phrase on the device, store it offline, consider a passphrase, and treat any request for your words as a scam.
Before you set up either device, read the seed phrase guide. For how this site researches and dates its facts, see the methodology.
