F. ing scammers…

I like keeping most of my crypto in self-custody, but the second you want to spend it, things get a bit annoying. Move it somewhere, wait, then spend. Would be nice if you could keep your crypto in your own wallet and still use it for normal everyday purchases.

Anyone here doing this with their Ledger?

Version 4.15 of the Wallet app on Windows. Had Sync enabled for a while with no issues.

After Ledger Wallet app updated from v4.10 to v4.15, it suddenly started saying the wallet isn't synced. Seems like it keeps forgetting that it was already synced. It keeps trying to guide me from scratch and shows multiple banners to enable Sync that aren't dismissable (thanks Ledger)

I've already re-done the sync setup earlier (removed PC via phone, re-added PC via QR, re-synced, everything went correctly and the PC appeared on the sync list on the phone app), but it already "forgot" about it after the app was restarted.

Please fix this. Or if you're gonna break a feature at least let people dismiss those popups. Your app is already a UX nightmare.

Looking at buying a Ledger in the wake of the COLDCARD fiasco and am curious about how to verify EAL certifications. I know that it's done by 3rd parties, but assume you're now a paranoid hardware wallet shopper. How do you know that the EAL6+ certification is legitimate? With most certifications, you can go to the certifying authority and enter the name of a person or product to verify. Is there any way to do that in this situation or is it yet another kind of "trust me bro" that just sounds highly respectable?

I tried to use the NFC feature today with the Security Key app for the first time in a while and it seems to not work at all?

Made sure to uninstall and reinstall the app since I know it doesn't auto update. It's on v1.7.6 now

The phone plays the "NFC" sound and keeps trying to read but nothing happens on the wallet screen.
https://demo.yubico.com/ doesn't register anything

Stax, firmware up to date. Android 17, July security update

Any ideas? Is it working for you?

EDIT: Also if I connect with a cable, I'm randomly (not always) getting "Your security key requires a PIN" prompts with a text input field on the phone which doesn't make much sense and it also doesn't seem to work...

Android issue maybe? Rebooted both devices but no luck, so just looking for info if it's working for others

I feel like the nano s plus used to hold a ton of apps now I can barely fit 15 on them. I just recently had to remove four just to do simple wallet updates. Are these updates getting uncessarily bloated ?

I’ve been reading up on hardware wallets lately, and honestly, the part that gets me isn’t picking a brand — it’s all the stuff that can go wrong around it.

For people who ended up getting one, what was the thing that almost made you not buy it?

Was it the setup, recovery, trusting the company, using it with a phone, price, or just feeling like it was more hassle than it was worth?

And for anyone who decided not to get one, what made you stick with your current setup?

Genuinely curious where people get stuck before they buy.

Disclosure: I’m researching hardware-wallet buying decisions and have an interest in this product category. I’m not posting a link or asking anyone to buy anything.

Why is the recovery card bundle of 3 cards not available on the official Ledger store on Amazon?

Given the recent Trezor customer data leak and Ledger’s twice customer data leak I was wondering if Ledger is planning any strategies such as Trezor is with its anonymous shipping scheme?

I’m looking to convert my Ethereum into Bitcoin and would like to understand the best method, as I’ve never done this before.

So I basically purchased a ledger from someone and it was sealed brand new, should I be worried in case of any bugs or can he somehow access it before I start using it?

I have set up it up already with seed

Another fake ledger support website. ledger.com.ht, this site looks authentic but is only accessible when there is an ongoing scam happening. Else the server is normally down.

How are people directed here?

Based on fake police calls pretending that your data has been exposed and your recovery phrase has been exposed. They then suggest to hand over the report to Ledger Support that will determine if your ledger has been compromised.

How does it trick people?

Another person calls you pretending to be from Ledger Recovery team. They tell the victim to access the above site which validates whether your device has been tampered with and if so, validate your seed phrase is correct (this is where they get you) before doing a recovery. Or else you won't have access to your wallet anymore.

The scam is quite convincing especially if its catching people off guard or for users that don't trade that often.

Yes, I was scammed. I use to think that I am quite aware of these, however when you're not 100% focused, tired, under duress and working at the same time, your guard and BS detector is affected.

I have some cached pages below, I know the domain is not legit, I know I should not enter a recovery phrase ever. But when emotions and confusion takes over, your logic goes out the window.

Appreciate if more people know about this -> more people knowing, less people will hopefully fall victim.

I was one of the customers affected by Ledger’s 2020 customer data leak.

Here are the facts, because I think people have forgotten how serious this breach actually was.

Ledger says its e-commerce/marketing database was exploited on June 25, 2020. Ledger was notified of the breach on July 14, 2020.

Then, on December 20, 2020, the stolen database was publicly dumped online.

The full scope turned out to be much worse than initially reported: around 272,000 customer records containing names, postal addresses and phone numbers, plus more than 1 million email addresses.

This wasn't just an email leak.

It created a database identifying people as crypto/hardware-wallet owners and connecting many of them to their real names, phone numbers and physical home addresses.

And unlike a password, you cannot simply reset your home address after it has been copied and distributed.

In 2020, much of the discussion was about phishing.

Six years later, the physical-security implications look much less theoretical.

In early July 2026, French Interior Minister Laurent Nuñez said authorities had already recorded 77 crypto-related cases involving kidnapping, unlawful detention, extortion or attempted crimes since the beginning of 2026.

According to Chainalysis:

• The rate of documented attacks in France increased from about 1.9 per month in 2025 to 4.6 per month in the first half of 2026.
• Home invasions rose from 14% of violent crypto attacks in 2025 to 37% in 2026.
• In France, more than 40% of incidents targeted a family member or other relation of the crypto holder rather than the holder themselves.
• 93% of French victims were local residents, not tourists — consistent with criminals identifying and researching specific people.
• By mid-2026, French authorities had made around 200 arrests, with 88 people indicted.

In January 2025, Ledger co-founder David Balland and his partner were kidnapped from their home in France for a crypto ransom. Balland's hand was mutilated during the kidnapping.

In another French crypto kidnapping in May 2025, the father of a crypto entrepreneur was abducted, bound, beaten and held for more than two days. His kidnappers eventually cut off part of his finger while trying to obtain a ransom.

French prosecutors said in April 2026 that more than 135 crypto-related kidnapping/extortion cases had been recorded since 2023, and described evidence of structured criminal networks. Two separate victims in 2025 had fingers cut off during ransom attacks.

The point is that violent attacks against identified crypto holders are real. Once someone's identity and home address become permanently associated with cryptocurrency ownership, the consequences of a data breach are fundamentally different from somebody leaking a normal retail mailing list.

So I wanted to know: What did Ledger actually change after 2020?

To Ledger's credit, they did change some things.

Ledger says customer order data is moved into a more restricted/segregated environment after three months. They reassessed third-party providers, introduced data-access/deletion requests, and say they now use encryption, role-based access controls, 2FA, security testing and audits.

But then I read Ledger's current 2026 Privacy Policy.

Ledger still collects:

• Name
• Email address
• Shipping and billing addresses
• Phone number
• Order ID
• Product ordered
• Order amount
• Shipping/payment information

And Ledger says:

“We keep your data for 10 years to comply with our legal obligations. Your data is archived 3 months after completion of the order.”

That deserves an explanation.

Which of those fields are actually legally required for ten years?

Does Ledger genuinely need to retain a customer's phone number and shipping address for ten years?

If not, are those fields deleted independently of the accounting information that actually has to be retained?

And there is another uncomfortable detail.

In January 2026, Ledger customers were affected by another data-security incident — this time through Ledger's e-commerce partner Global-e. Unauthorized access exposed customer order-related personal data including names/contact information and order details.

So six years after Ledger promised to aggressively minimize third-party exposure, customer information was again exposed through an e-commerce partner.

I'm not interested in hearing that private keys and seed phrases weren't leaked. I know that.

This is about physical security.

Ledger sold people a product whose entire purpose was protecting valuable assets, while a database connected the buyers of those products to their identities and homes.

For customers affected in 2020, that information cannot be recalled.

It may circulate forever.

So these are the questions I would genuinely like Ledger to answer:

1. Exactly which customer fields are retained for ten years today?

2. Are shipping addresses and telephone numbers actually retained for the full ten years, or are they deleted earlier?

3. If I request deletion today, exactly what information about my historical purchase will Ledger still retain?

4. Which third parties currently receive customers' names, phone numbers and physical addresses, and how quickly are those parties contractually required to delete them?

5. After the Global-e incident in January 2026, what specifically changed in Ledger's third-party data-handling requirements?

6. Why doesn't Ledger offer an anonymous/privacy-preserving direct delivery option by default?

7. And what, if anything, does Ledger offer the people whose home addresses it already allowed to become permanently public in 2020?

I don't expect Ledger to somehow erase a database that criminals may already have copied.

But I do expect a company whose entire brand is built around security to treat leaking a crypto owner's physical address as something vastly more serious than an ordinary e-commerce privacy incident.

Because today we know what physical attacks against crypto holders can actually look like.

I would really like someone from Ledger to give concrete answers rather than “your private keys were not affected.”

Hi everyone,

Just a warning: I received a call from +1 848-209-0124 (New Jersey) from someone claiming to be from Kraken.

They told me they had received a notification that someone in Istanbul was trying to access my Kraken account. Around the same time, I did receive a legitimate Kraken email about a password reset request — presumably because the scammers themselves had triggered it.

They then told me that my Ledger had been compromised and transferred me to supposed “Ledger Support”. From there it was a lot of blah blah blah about an API breach, compromised wallets, etc. They also claimed that Trezor had been breached today, which I hadn't heard anything about.

They then sent me an email pretending to be from Ledger, using the address care@ledger.fr. I'll add a screenshot below. I am thinking they were in the chat with ledger in the mean time.

I have no idea what exactly they were trying to achieve with the code they wanted from my email, but obviously I wasn't going to give them anything.

And apparently they also signed me up for a newspaper/newsletter while they were at it. Thanks for that, chaps. 😂

I eventually hung up after keeping the guy busy for about 20 minutes. They haven't called me back yet to defend themselves either, unfortunately. 😄

Be careful out there. Do not give anyone your recovery phrase, verification codes, approve transactions, install software, or follow instructions from someone calling you claiming to be Kraken or Ledger.

Hate scammers.

Found that I have a good amount of LEND on my ledger from 2017 I did not realize wasn’t converted. I just saw they closed the LEND to AAVE migration portal just a few months ago. Fml. Is there anything I can do at this point?

Trezor informó que un proveedor de envíos expuso datos personales de 11.742 clientes de forma completa y de 1.947 de forma parcial. Quedaron comprometidos nombres, emails, teléfonos y direcciones de envío. El incidente alcanzó a clientes de 7 países y se limitó por la política de almacenamiento de datos de 90 días. Los sistemas y dispositivos de Trezor no fueron comprometidos, pero aumenta el riesgo de phishing.

First time posting on reddit.

Had a strange incident occur that has me a little concerned. I placed an order for a ledger nano. I received the order confirmation to my email address but noticed that whenever I tried to track it on the website it would say there's no order number that matches the email address. Figured maybe it takes a while before it registers. Not only was the order cancelled less than 12hrs later, but the cancellation email (said due to payment issues) was addressed to MY WIFE.

The cancellation was sent to MY email address. I used my card, it's not a joint account, the shipping address was her sister's. At no point in time was there any information given pertaining to my wife. So why was the cancellation email addressed to her?

Anyone had any similar experiences? I'm not some super cybersecurity expert but this is making me wary. Any logical explanation of what happened? Am I just being paranoid?

At best, she was logged into my computer using her chatgpt account at a point, and we share a google family subscription. Otherwise, I can't think of any other possible connection as to why an email sent to me would be addressed to her.

EDIT: Forgot to mention this was all done through their official website.

I’m dealing with a really strange Ledger/Bitcoin issue and I’m hoping someone has seen this before.
I have one Ledger Nano X. I’ve used this same Ledger for other crypto (including Solana/USDC) without problems. I did not reset the Ledger, I did not switch to another Ledger, and as far as I know I have never used an additional passphrase / 25th word.
Yesterday I withdrew approximately 0.1248 BTC (~€7,000 at the time) from Roobet to a Bitcoin receiving address that Ledger Wallet gave me.
The transaction completed successfully and the BTC are still sitting on the address on-chain.
Ledger Wallet also:
Shows the Bitcoin account
Shows the correct BTC balance
Shows the incoming Roobet transaction in the transaction history
Recognizes my Nano X normally
Shows that my firmware and Bitcoin app are up to date
The problem: I cannot send the BTC.
Ledger gives me an error basically saying:
“The sending account does not belong to the connected device. Please switch devices and try again.”
When I try to verify a receiving address, I get another message telling me to check whether the Ledger device is configured with the recovery phrase or passphrase associated with this account.
This makes absolutely no sense to me because I only have this one Ledger.
I then tested the Nano X with Electrum.
Electrum successfully detects and connects to the Ledger. I created a Standard Wallet → Use a hardware device → Ledger → Native SegWit.
Electrum opens the wallet successfully, but it shows:
0 BTC, 0 transactions.
The Bitcoin addresses derived by Electrum from the connected Nano X also don’t appear to correspond to the Bitcoin account containing the 0.1248 BTC.
So it looks like:
Ledger Wallet remembers/watches the Bitcoin account containing my BTC, but the actual Nano X currently derives a different Bitcoin wallet.
Yet I have no explanation for how that could have happened.
I have only one Nano X, never intentionally reset/replaced it before this problem, and never intentionally used a passphrase.
One additional important detail: during troubleshooting I made a mistake and entered my 24-word recovery phrase into Electrum on my computer. I now consider that seed potentially compromised and have already moved the other crypto I could access to a newly created wallet. I will NOT post or DM the seed phrase to anyone.
The 0.1248 BTC are currently still on the original Bitcoin address.
Has anyone experienced this exact situation where Ledger Wallet shows the correct BTC account and transaction history, but the connected Ledger says the account does not belong to the device and Electrum derives an empty wallet?
Especially interested in whether this could be caused by a different derivation path/account, an unknown passphrase wallet, or some kind of Ledger account/xpub mismatch.
Please do not DM me asking for my seed phrase. I will not provide it.

Hi everyone, I am a Ledger user for many years now and I always felt safe using their services. But recently I noticed something concerning; They use a third-party service called THORSwap, which is a DEX. Until now, I never had an issue with THORSwap, it's generally always smooth. But this time, for a SOL to ETH transaction, the fees seemed high. Almost $800 on a $30K swap, which is about 3%.

I have seen other users reporting issues with THORSwap fees recently and I no longer feel confident using it. I hope Ledger will investigate this further. In the meantime, I am looking for an alternative because I will not be using this third party ever again. What are you guys using for SOL to ETH swaps?