Security & Anti-Phishing
Seed phrase discipline · phishing · risk checklistMost Ledger losses come from seed-phrase exposure and phishing — not from the device itself. This page is an executable discipline checklist: what you must never do, what real attacks look like, and how to recover when something feels off.
Ledger Anti-Phishing Guide | Identifying and Defending Against Scams
This page helps identify and defend against phishing scams targeting Ledger users.
Phishing Characteristics
Fake official sites usually have subtle differences in the domain; the page asks you to enter your recovery phrase; urgent-alert popups pressure you into action.
Core Principle
The official side will never ask for your recovery phrase; any page asking you to enter the recovery phrase is a scam; verify through the official site if in doubt.
If Scammed
If you have already leaked the recovery phrase, immediately move the assets to a brand-new wallet; if you only clicked a link without entering anything, the risk is lower.
How to Protect Your Ledger Recovery Phrase | Secure-Storage Best Practices
The recovery phrase is the core of asset security; protecting the recovery phrase is even more important than protecting the device itself. Below are field-tested best practices.
Choosing a Storage Medium
Paper recording: the simplest approach — use the card that comes with the Ledger or ordinary paper and a pen. Pros: simple and accessible. Cons: paper is vulnerable to fire and water.
Metal recovery-phrase plate: the recovery phrase is engraved on a metal plate, resistant to fire, water and corrosion. Dedicated products are available on the market, and you can also DIY with stainless-steel washers. Suitable for long-term storage.
Where to Store It
Choose a secure, private and disaster-resistant location: a home safe or a concealed spot; a bank safe deposit box; a trusted relative's home (without disclosing the specific contents). Avoid locations that are easy to discover or vulnerable to disasters.
Multiple Backups
It's recommended to make 2–3 backups stored in different locations — so that even if one site is struck by fire, flood or theft, another backup is still usable. However, more backups mean higher leak risk; balance accordingly.
Split Storage (Advanced)
Advanced users may consider splitting the recovery phrase into parts and storing each part in a different location. This adds complexity and requires careful design to ensure that no single part alone is enough to restore the wallet.
Absolutely Forbidden
Do not photograph it, do not save it on a phone, do not save it on a computer, do not save it in a cloud drive, do not send it via email, do not tell anyone. Any digital form of storage faces the risk of being stolen by hackers.
Is Ledger Safe | Comprehensive Security Analysis
Ledger hardware wallets use bank-grade Secure Element chips. The devices themselves have never been remotely compromised, but overall security still depends on correct usage by the user.
Device Security Mechanisms
Ledger uses a CC EAL5+ certified Secure Element chip — the same class of technology as bank cards and passports. The private key is generated and stored inside the chip and never leaves it. Signing is performed inside the chip, which only outputs the signature result. Even if the connected computer is compromised, the attacker cannot extract the private key.
Historical Security Record
Since the first Ledger device launched in 2014, there has never been a reported case of a user losing assets because a device was remotely compromised. The 2020 data breach was a breach of the company's customer database, exposing user email addresses and physical addresses, but this had no bearing on device security — no private keys on any device were leaked as a result.
Security Boundaries
What Ledger can protect: the private key from remote theft; transactions require physical confirmation. What Ledger cannot protect against: a user actively disclosing the recovery phrase; a user signing a malicious transaction on a phishing site; a user's recovery-phrase backup being obtained by someone else.
User Responsibility
Device security is one piece of a larger system. Users need to: safely store the recovery phrase; stay alert to phishing and scams; buy devices only through proper channels; carefully check the information before signing transactions. Most asset-loss cases stem from user operational errors rather than the device being compromised.
For anti-scam knowledge, see the Ledger Anti-Scam Guide.
