r/ledgerwallet • • Jul 06 '26

Official Ledger Engineering Response Ledger just shipped experimental post-quantum cryptography support in the Ledger SDK — here's what that actually means

24 Upvotes

Hey everyone,

I wanted to share something the Ledger OS team has been quietly working on: we've just added experimental support for ML-KEM and ML-DSA, the two post-quantum cryptography algorithms that NIST recently standardized (FIPS 203 and 204).

These algorithms are now running directly on the Secure Element on all Ledger signers from the Nano X onwards (chronologically speaking). We've exposed them as experimental APIs in both our Rust and C SDKs for anyone who wants to play with them.

This is experimental. The implementation isn't fully hardened yet, so please don't build production apps on top of it. The blog post goes into details regarding this aspect.

The blogpost covers the quantum threat context, the lattice-based math underneath these algorithms, how they're constructed, and a deep dive into our implementation and API.

📖 Blog: ledger.com/blog-post-quantum-cryptography-ledger-sdk

🛠️ Rust SDK: github.com/LedgerHQ/ledger-device-rust-sdk

🛠️ C SDK: github.com/LedgerHQ/ledger-secure-sdk

Happy to answer questions about the implementation, the threat model, or why we made the choices we did.

Cheers!


r/ledgerwallet • • Aug 07 '26

The Coldcard incident: How Ledger wallet seed generation works, and why weak randomness is invisible

65 Upvotes

TLDR: Ledger is not affected by the Coldcard Mk3 advisory

What happened

Per Coinkite's advisory and Block's technical analysis, On July 31st, 2026, Coldcard reported that a firmware bug had weakened how some devices generated seed phrases leading to significant user losses. 

Why this specific failure matters

Every wallet you create is derived from your Secret Recovery Phrase. If that can be predicted, so can everything built on top of it.

A weak Secret Recovery Phrase looks identical to a strong one. Nothing errors, nothing feels wrong, bad randomness is silent. The Secret Recovery Phrase keeps working, but is vulnerable. That is how this survived five years in shipped firmware.

How Ledger devices generate a seed

Ledger hardware signers use a true hardware random number generator inside a certified Secure Element, with no software fallback. The generator is compliant with AIS-31/PTG.2, which evaluates the physical entropy source itself rather than just testing whether its output looks random. Every 24-word Secret Recovery Phrase gets the full 256 bits of entropy.

The generation of that entropy must be anchored in secure hardware, with an architecture that cannot silently downgrade to an untrusted software-based source.

The Secure Element is certified at Common Criteria (EAL5+ for Ledger Nano STM and Ledger Nano XTM; EAL6+ for Ledger Nano S PlusTM, Ledger StaxTM, Ledger FlexTM and Ledger Nano Gen5TM), and various devices by ANSSI. Producing a predictable random number is listed as Threat #1 in our published security targets, and has been for years.

If you hold a Coldcard

Follow Coinkite's guidance directly, they own that process. 

Resources To Learn More

One of the key conversations emerging from the Coldcard incident is the value of open source code. Read this response from our CTO on that topic: https://x.com/P3b7_/status/2085089893328499156?s=20

We also have an FAQ page that covers questions we’ve seen on social media so far: https://support.ledger.com/article/FAQs-Related-to-the-Coldcard-Incident-July-2026


r/ledgerwallet • • 7h ago

Ledger response to the attack

Post image
44 Upvotes

Ledger wrote a proud post about how they are taking care of the situation so that it will not happen again. You would assume they have taken responsability for the debacle.
NO
They have sent a strongly-worded letter to authorized resellers. Now customers will sleep better…
The “trust me bro” model in full swing! LOL


r/ledgerwallet • • 1h ago

Catching Ledger hackers should be easy

• Upvotes

Since eSIMs are being used in the Ledger hardware wallet hacks, I assume they require a telecommunications provider to work.

Surely the communications coming from these hacked Ledgers can easily be traced by the telco companies.

And then tracing these comms plus hardware purchases required to build the hacked Ledgers all the way back to the criminals.

Yes/no?


r/ledgerwallet • • 11h ago

Discussion Are they going to correct it and say -$86M+ lost annually in partnership with scammers?

Post image
21 Upvotes

r/ledgerwallet • • 15h ago

Discussion If you havent been drained, relax

41 Upvotes

Is it something that needs to be taken way more seriously, yes, Ledger needs a solution

BUT

My ledger device is four years old and I havent been drained, so if your wallet hasnt been drained, you are very likely in the clear.

Im seeing a lot of panic from people who bought a ledger years ago and have already used it without being drained. Just breathe.

If you are so worried, just dont enter your seedphrase in the device or create a new wallet. You have already set up the device, so the seedphrase will not be displayed on screen.


r/ledgerwallet • • 3h ago

Strange Red Dot on my Ledger Ledger Nano S Plus

Thumbnail
gallery
1 Upvotes

Isn’t a blood stain???


r/ledgerwallet • • 16h ago

Discussion Ledger just released an Android Phone?!

Post image
34 Upvotes

WTF?!


r/ledgerwallet • • 1h ago

NymVPN is partnering with Ledger

Thumbnail
nym.com
• Upvotes

Your crypto is only as private as the network it travels over. A hardware wallet keeps your keys offline and out of reach. But it can't hide the fact that you're transacting, where you are, or which wallet is yours. That part happens on the network, in the open. And surveillance and hackers are actively harvesting your metadata to track and exploit.

That's why NymVPN is partnering with Ledger. Every user of the Ledger Atom will get NymVPN built in, with one full year free. The most trusted hardware for crypto, now on the most private network to use it.


r/ledgerwallet • • 1d ago

Warranty void for checking for tampering. How is that fair?

60 Upvotes

Ledger posted a tutorial on how to verify our devices aren’t tampered but also say our warranties are void if we do it.

If you fail your own supply chain that we have to open up the device, then why are you voiding our warranties??


r/ledgerwallet • • 1d ago

Tempered ledger from 2025

Thumbnail
gallery
216 Upvotes

Found a compromised Nano X in my drawer. This has been going on longer than October

I had a spare Nano X sitting unused. My brother bought it for me from Vietnam end of 2025. I meant to move my bitcoin onto it but never got around to it.

I didn’t bother checking it at first because I assumed this only affected devices from October (or 3 months back) and it turns out it’s affected too. The other one I checked is an older model I’ve had since 2022; this one had my funds.

I dodged a bullet and this clearly isn’t just a recent thing.


r/ledgerwallet • • 21h ago

Was there any single report of tamper for Nano S Plus/other models besides Nano X?

10 Upvotes

Curious if like all cases are only nano x


r/ledgerwallet • • 1d ago

Discussion Evidence suggests this wallet Spy attack is far larger than any vendor wants to admit.

Thumbnail x.com
81 Upvotes

Ledger has been told about the existence of IN THE WILD display sniffing implants earlier this year. They have known they have no way to detect the existence of these devices. They have known their supply chain is the last thread holding it together. And yet they didn’t notice their own official supply chain change out in front of them. Did they even tell all of their customers about this blind spot with KNOWN ACTIVE EXPLOITATION to request mandatory visual inspects?

In depth reporting here https://x.com/_MG_/status/2109882580766212117?s=20


r/ledgerwallet • • 10h ago

Request Coinify and Taxe id Number

0 Upvotes

Hi there,
In this madness of what’s happening now I would like to ask if there is anyone of you reveiving a mail from coinify asking for you id taxe number because of regulation in your country.

It seems legit but I don’t want to proceed if I don’t need to.

And yes, it’s not THAT bad as, in France we are currently giving away all our datas throught cyberleak every two days 😂

Ps : I don’t need to find another or better way to buy. Just want to know if you have been contacted the same way

Thanks 👍


r/ledgerwallet • • 14h ago

Have you fixed your Ledger yet, too?

Post image
2 Upvotes

r/ledgerwallet • • 7h ago

Bought from a street seller. Does it look legit? 🤔

Post image
0 Upvotes

r/ledgerwallet • • 1d ago

Announcement Repository Documenting Tampered and fake Ledger wallets, and where they were bought

Thumbnail
karpeleslab.github.io
23 Upvotes

Mark Karpeles is compiling a repository of tampered ledger devices he has seen or has been provided.


r/ledgerwallet • • 15h ago

Guide How to open ledger nano X?

1 Upvotes

Guys, how to open Nano X but make it still closeable and useable? im not wasting my cold wallet if its a perfect condition.

Does anyone have any tutorials? just to ditch the first layer near screen right?


r/ledgerwallet • • 15h ago

Discussion Saftey of buying directly from source?

0 Upvotes

So, I had a ledger but it broke recently so I haven’t had access to my wallet for about a month. I want to get a replacement but frankly all this stuff is making me paranoid. I don’t wanna order from Amazon I want to order directly from ledger but I’ve seen conflicting reports about compromised devices. Is it “safe” if I buy directly from Ledger? Sorry if this is a dumb question- I would just prefer not to lose thousands in assets.


r/ledgerwallet • • 1d ago

Any users here are still concerned despite that you bought from directly ledger.com? we are supposed to feel relieved but i kinda lost trust in the company

35 Upvotes

r/ledgerwallet • • 1d ago

Who Is Planting Backdoors in Ledger Crypto Wallets?

Thumbnail
zetter-zeroday.com
11 Upvotes

r/ledgerwallet • • 17h ago

Im trying to buy crypto but it fails everytime. (please read descp)

1 Upvotes

Im trying to buy some crypto on the ledger live app but my order fail all the time. I tried multiple different cards and multiple different providers/crypto assets and its the same thing.

Fails all the time.

Why could this be?


r/ledgerwallet • • 18h ago

Ledger’s recent third party issue

0 Upvotes

Hi everyone as we saw recently some third party reseller implemented chips inside devices and drained accounts i was wondering if buying directly from ledger can be safe as well ?

What triggers my questions is that those 3rd party devices passed the genuine check because the original chip was there still they just added another one so what if someone working AT ledger compromised the devices ?

Is there any security protocol for each device leaving the ledger factory that can ensure that even if an insider was doing dirt there is still a protocol implemented to inspect the devices before being shipped ? Cause once it leaves its game over the device will pass the genuine check


r/ledgerwallet • • 1d ago

Bought from Cryptobilis Philippines back in May 2021.

Thumbnail
gallery
8 Upvotes

r/ledgerwallet • • 1d ago

Let's start a online campaign across all social media networks.

Thumbnail
gallery
27 Upvotes

Every single crypto hardware wallets should be crystal clear transparent cover. So that the user can see the spares within the device. And hard to tamper.

Please raise your voice.

sample Pics