HostNexFlow › Library › Ledger vs Trezor
Ledger vs Trezor: the two hardware custody answers that finally met in the middle
The oldest rivalry in hardware custody now converges: Ledger ran closed firmware on a certified secure element; Trezor ran fully open source without one — until the Safe line added a secure chip anyway. What still differs is what each asks you to trust, and each has a documented breach file to price.
For a decade the Ledger–Trezor choice was the cleanest philosophical split in crypto custody: certified tamper-resistant silicon you cannot audit versus fully auditable code running on commodity silicon that, famously, gave up seeds to physical attack. Since late 2023 the split narrowed — Trezor's Safe line added a secure element — but the trust models still differ in ways worth pricing before you store anything serious.
Every row below names its source and date.
The parameter table
| Parameter | Ledger | Trezor |
|---|---|---|
| Architecture | Closed-source BOLOS firmware on a certified secure element (ST33-class, EAL5+); signing isolated from the host MCU (Ledger docs, as of 2026-09-28). | Fully open-source firmware; Model One/T have no secure element, the Safe line (3/5/7) added an Optiga Trust M-class EAL6+ secure chip — and Safe 7 shipped the auditable TROPIC01 element (SatoshiLabs docs, as of 2026-09-28). |
| Verifiability | Firmware sealed by the chip vendor; you verify by certification and Ledger Donjon's published research, not by reading the signing code. | All code public and reproducible; Safe-line devices combine the auditable stack with the tamper-resistant chip — the convergence point. |
| Physical extraction | No public in-lab seed extraction against an SE Ledger model on record; the chip is the whole defense (Donjon research file). | Model One/T are physically extractable by fault-injection labs — Unciphered demonstrated it publicly — the exact gap the Safe line was built to close. |
| Backup model | Standard 24-word seed; optional Ledger Recover splits encrypted key material across Ledger, Coincover and EscrowTech behind identity verification (docs). | Standard seed plus Shamir SLIP-39 shares on Safe/Model T — split backups without a third party (SatoshiLabs docs). |
| Companion app | Ledger Live — mobile and desktop, swaps/staking via integrated partners (vendor docs). | Trezor Suite — desktop and web with optional Tor; lighter mobile story (vendor docs). |
| Vendor / founded | Ledger SAS, France, 2014. | SatoshiLabs, Czech Republic, 2013 — the original hardware wallet. |
| Incident file | July-2020 e-commerce breach — ~272,000 order records (names, addresses, phones) dumped publicly Dec-2020, feeding phishing and physical-threat letters; Dec-14-2023 ConnectKit supply-chain attack — a phished ex-employee's npm account shipped a drainer (~$600K taken, <2h window) to every dApp using the library. | January-2024 support-system breach exposed ~66,000 contact records (names/emails); April-2022 Mailchimp-driven phishing of Suite users; the Unciphered Model-T extraction demos sit in the design column. |
The chip split — and how it closed
Ledger's bet was that commodity microcontrollers can't be trusted with keys: it signs inside a certified secure element running closed firmware, where the attack surface is an expensive lab problem. Trezor's bet was the opposite: trust nothing you can't read — fully open firmware on standard parts, reproducible builds, Shamir backups. Each called the other's architecture the actual vulnerability.
Reality graded both. Physical-extraction labs (Unciphered, among others) demonstrated seed recovery from SE-less Trezor models — SatoshiLabs's answer was the Safe line, adding an Optiga Trust M secure element in 2023 and shipping the industry's first auditable element (TROPIC01) in the Safe 7. Ledger's SE, meanwhile, has no public extraction on record — but the ConnectKit incident showed a different attack surface entirely: the ecosystem around the device.
The breach files, priced honestly
Neither company has lost user keys to a device hack in normal use — the damage files are both about the customer data around the device. Ledger's July-2020 e-commerce breach leaked order records — names, physical addresses, phones for ~272,000 buyers — and its December dump produced years of phishing plus the documented extortion letters threatening home visits. Trezor's January-2024 support-system breach exposed ~66,000 contact records — emails and names, not purchase addresses — plus an earlier Mailchimp phishing wave against Suite users.
The asset never breached was the seed; what leaked was who owned the device. A hardware wallet's worst realistic loss isn't a hacked chip — it's a phished user or a leaked address list. Ledger's breach is the heavier one on paper (physical addresses carry a threat model emails don't), and ConnectKit proved a supply-chain attack can drain users of any wallet through a shared library. Neither file is a reason to avoid hardware custody; both are reasons to treat the purchase record and every unsolicited contact as part of the attack surface.
Recovery: three approaches, three trust shapes
Both ship the standard 24-word backup you write down. Trezor adds Shamir (SLIP-39): split the seed into shares requiring a threshold to recombine — an option with no third party in the loop. Ledger adds Recover: an optional paid service that encrypts your key material, splits it into three fragments held by Ledger, Coincover, and EscrowTech, and restores behind identity verification — its May-2023 announcement produced the community's sharpest backlash precisely because it proved the firmware could export key material at all.
The controversy clarified the real question each device answers: Trezor asks who can reach your seed — answer: nobody but you, unless the device is physically taken (Safe line) or extracted in a lab (older models). Ledger asks whether you can recover from loss — with an optional, named third-party path that trades a slice of secrecy for survivability.
Living with each
Ledger Live is the more complete companion: mobile and desktop, staking and swaps via integrated partners, the hardware line spanning Nano S+, Nano X, Flex, and Stax. Trezor Suite is desktop-and-web native with a Tor toggle and a lighter mobile story. Both pair with third-party wallets and both support the major assets; the everyday difference is software polish versus software minimalism.
Supply-chain caution applies equally at purchase: buy direct, check the device's attestation on first connect, and treat any seeded 'pre-configured' unit as hostile — both vendors document counterfeit and pre-seeded-device fraud in their support files.
Who should pick Ledger, who should pick Trezor
Pick Ledger if you want the certified-chip model, the fuller companion app, the broadest asset coverage, and you can live with a closed firmware stack plus the option (never required) of Recover. Pick Trezor if auditability is the point — fully open firmware, reproducible builds, Shamir backups — and choose a Safe-line model for the secure element the Model One/T never had.
The honest either-way answer: buy the Safe 5/7 or any current Ledger and your remaining risks are social and procedural — phishing, the purchase channel, and how you store the backup — which neither device can fix for you.
Frequently asked
Is Ledger or Trezor more secure?
Different defenses: Ledger's secure element has no public extraction on record but runs closed firmware; older Trezors (One/T) were physically extractable — the Safe line (3/5/7) added a certified chip, and Safe 7's TROPIC01 is auditable. Current-generation devices of either brand are strong; the residual risk is phishing and purchase-channel fraud.
Did Ledger or Trezor leak customer data?
Both — Ledger's July-2020 e-commerce breach exposed ~272,000 order records including physical addresses (dumped publicly that December, driving years of phishing and extortion letters); Trezor's January-2024 support breach exposed ~66,000 contact records — emails and names, not addresses.
What was the Ledger ConnectKit hack?
December 14, 2023: a phished ex-employee's npm account published a drainer inside the ConnectKit library (v1.1.5–1.1.7); ~$600K was stolen from users of any wallet connecting to affected dApps in a sub-two-hour window. It hit the ecosystem, not the hardware — but it lived inside Ledger's supply chain.
Ledger Recover or Trezor Shamir?
Opposite trust models for the same problem: Recover encrypts and splits your key material across three named companies behind identity verification; Shamir (SLIP-39) splits your seed across shares only you hold. Recover survives losing your backup; Shamir involves no third party at all.
Do Ledger or Trezor report to the IRS?
Neither — hardware vendors file no tax forms; Ledger's optional Recover creates an identity-linked record at its providers, but the devices themselves report nothing. Gains and losses on the wallet are the user's reporting job.
Which supports more assets?
Ledger — its asset coverage through Ledger Live plus partner integrations is the broader of the two. Trezor covers the majors through Suite and pairs with third-party wallets (MetaMask, Rabby, others) for the long tail.