Trezor vs Ledger: which is safer for a normal person?
Published · Updated
Short answer: For a normal person, neither brand is clearly safer. Current models of both use dedicated security chips, and both have had real incidents. Where you buy, never typing your recovery phrase anywhere, and reading what you approve matter more than the logo. Trezor is more open source; Ledger offers optional, ID-based Recover. (Trezor; Ledger)
What this covers: Trezor vs Ledger on the risks that actually drain normal people: a side-by-side table on open source, supply-chain checks, backups (Ledger Recover vs Trezor Multi-share Backup), what you see when you sign, and phishing for your recovery phrase, plus where to buy each one safely. Who it's for: you, if you're choosing your first hardware wallet, or you own a Ledger or Trezor and the October 2026 implant news has you wondering whether to switch. What it isn't: a price shootout, a "best wallet" ranking or investment advice; this page has no affiliate links, coin calls or exchange referrals, and we have no deal with either company.
Key facts
- Trezor says the software in its devices "has always been open-source." Ledger says its OS and software are about 95% open source or reviewable; the closed part is low-level code for its Secure Element chip, which its chipmaker agreement keeps private. (Trezor; Ledger, 2024-07-18)
- The October 2026 CryptoBilis implant read the recovery phrase off a genuine Ledger's screen and still passed Ledger's Genuine Check. Trezor said its setup checks target counterfeits and modified firmware, that this implant "works differently," and that it hasn't seen it on Trezor devices. (Ledger Donjon; Cointelegraph, 2026-10-13)
- Ledger Recover is opt-in and paid: an encrypted backup split across three companies, unlocked by ID checks. Trezor's Multi-share Backup splits your backup into shares you keep yourself. (Ledger; Trezor)
- Both now show many smart-contract transactions in plain language ("Clear Signing"), and both fall back to a blind-signing warning when they can't. (Ledger; Trezor, 2026-09-07)
- Both say they will never call or text you, and both have had customer contact data leaked: Ledger's database in 2020, Trezor's shipping provider in 2026 (80,689 customers). (Ledger; Trezor)
How do Trezor and Ledger compare on the risks that matter?
One row per risk. "What protects you" is what the vendor's own pages say the device or app does; "what doesn't" is the gap a normal person should plan around. All sources opened 2026-10-25.
| Risk | Trezor | Ledger | What this means for you |
|---|---|---|---|
| Can outsiders inspect the code? | Device software is open source and can be built and verified by anyone. Safe 3 and Safe 5 use an OPTIGA Trust M secure element; Safe 7 adds TROPIC01, which Trezor calls independently auditable. (Trezor) | Ledger Wallet app, embedded apps and SDK are open source; parts of the OS are reviewable. Low-level Secure Element code is closed under its STMicroelectronics agreement. (Ledger) | This is a real design difference, but it's a trust question for experts. None of the incidents we verified drained people through either company's closed or open code. |
| Tampered device (supply chain) | Ships without firmware; setup warns if firmware is already installed. Bootloader checks the firmware signature on every connect. Holographic seal over the port. Safe models run a chip-based authenticity check. (Trezor; Trezor) | Genuine Check proves the Secure Element is real. Ledger's own lab says it "cannot detect" added spy implants if the original chip is intact. (Ledger Donjon) | No vendor check promises to catch a screen-reading implant. Trezor's statement only says it hasn't seen one on its devices. Where you buy is your main defense on both. (Cointelegraph) |
| Losing your backup | Single 20-word backup by default, or Multi-share Backup: 1–16 shares, any threshold you choose (e.g. 3 of 5) restores the wallet. You hold every share. (Trezor) | 24-word phrase by default. Optional paid Ledger Recover: encrypted pieces held by Coincover, Ledger and EscrowTech; two of three plus ID checks restore your keys. (Ledger) | Recover trades a paper problem for ID checks and three companies. Multi-share trades it for more pieces of paper to store. Neither is on unless you choose it. |
| Phishing for your recovery phrase | "Any request for your wallet backup, PIN, passwords, or codes is always a scam." Trezor never contacts you by text, WhatsApp, Telegram, phone or letter. (Trezor) | Never enter your 24 words anywhere but the device. Ledger never contacts you by text or phone; scammers have posed as Recover partner Coincover. (Ledger) | Identical rule on both: the phrase goes on the device or on paper, never into a website, app, form or call. This is how most people lose funds. |
| Leaked name and address | ShipMonk breach (Aug–Sep 2026): 80,689 customers, mostly name, email, phone and shipping address. Trezor warns of phishing letters and calls. (Trezor) | 2020 database leak: about 1 million emails; names and addresses for about 272,000 buyers. Details on our Is Ledger safe? page. | Either way, a letter or call that knows your name and that you bought a wallet is not proof it's real. |
| Approving something you can't read | Clear Signing (Sep 2026) for supported EVM contracts on Safe 7, Safe 5, Safe 3 and Model T; unsupported contracts show a blind-signing warning. Not on Model One. (Trezor) | Clear Signing is standard inside Ledger Wallet. Blind signing is off by default; you must switch it on in the coin app, with a warning. Outside Ledger Wallet it depends on the dApp. (Ledger) | If your device shows only a hash or a blind-signing warning, stop. A drainer approval looks just like this: how drainers use approvals. |
| Where to buy | Official Trezor shop, its Amazon storefront, or a listed authorized reseller. Trezor is cutting some resellers on 2027-01-01. (Trezor; Decrypt) | Ledger.com or its official reseller list. A "Ledger store" on a marketplace may be run by a reseller, so check the operator. (Ledger) | Check the list on the day you buy. Lists change: Trezor said CryptoBilis was already off its list by mid-October. (Decrypt) |
Does open source make Trezor safer than Ledger?
It makes Trezor easier to audit, which is different from making your coins safer day to day. Trezor's position:
"The software used in Trezor devices has always been open-source to be fully auditable. Everyone can look at the code used in Trezor devices and verify its integrity, look for vulnerabilities, or suggest improvements and integrations."
Ledger's position is that a hardened smartcard-style Secure Element is worth keeping a small amount of chip-level code closed, and that "open-source software on non-secure chips" is exposed to physical attacks. (Ledger) Each company's page argues against the other's design, so treat both as advocacy. For a normal person, the attacks that actually emptied wallets in the incidents we've covered were phishing for the phrase, tampered resale units, a hijacked web library and signing things people couldn't read, not a break in either company's chip. (Is Ledger safe?)
Could a CryptoBilis-style implant happen to a Trezor?
Nobody has shown one on a Trezor, and nobody can promise it's impossible. The October 2026 attackers bought genuine Ledgers, added hidden parts that captured the phrase during setup, and resold them through resellers in Southeast Asia. Ledger said its "chip, operating system or servers" had no flaw; it was "an attack on the distribution channel." (Ledger, 2026-10-15) The timeline and what Ledger told buyers are on our Is Ledger safe? page.
- Ledger's check didn't catch it, by design. Ledger's lab says Genuine Check "cannot verify the device's physical supply chain history," and buying direct is safer for that reason. It also calls holographic seals "trivial to clone." (Ledger Donjon)
- Trezor's checks target a different attack. A Trezor spokesperson said its setup checks "are built to catch counterfeit devices and modified firmware," and that this implant "doesn't modify the firmware, but reads information on the screen." Trezor said it had seen no such attack on its devices. (Cointelegraph)
- CryptoBilis had sold both brands. Cointelegraph described it as an authorized Trezor reseller; Trezor said it had no reports of tampered Trezors from it. (Cointelegraph; Decrypt)
- Trezor's spokesperson suggested multisig "with devices from different makers, so one compromised device can't move funds on its own." That's sound but adds steps; it's worth it for larger amounts. (Cointelegraph)
Switching brands doesn't remove this risk. Buying only from the maker or its listed resellers does most of the work for either brand.
Ledger Recover or Trezor Multi-share Backup: which backup is safer?
They solve the same problem, losing your phrase, in opposite ways:
- Ledger Recover encrypts your backup inside the device, splits it into three pieces held in hardware security modules by Coincover, Ledger and EscrowTech, and restores with two pieces after you pass ID checks with two companies. It's a subscription; miss payments and you can't restore. It needs a passport, national ID or (in the US and Canada) a driver's license. (Ledger)
- Trezor Multi-share Backup splits your backup into 1–16 shares; any threshold number restores the wallet, and fewer than that reveal nothing. You store every share yourself, in different places or with people you trust. If you upgraded from a single backup, that original backup still works, so it still needs guarding. (Trezor)
Both are optional. The risk most people actually face here is a fake "Recover" or "backup verification" call: Ledger warns of scammers posing as Coincover, and Trezor says any message asking you to "verify your backup" is phishing. (Ledger; Trezor)
Which should I pick for my situation?
| Your situation | What matters most | Leaning |
|---|---|---|
| You want the code to be inspectable by outsiders | Open-source firmware and an auditable secure element | Trezor's design fits this goal more closely. (Trezor) |
| You're afraid of losing paper and are fine with ID checks | A backup you can restore without the paper | Ledger Recover exists for this; read the terms and costs first. (Ledger) |
| You don't want any company holding any part of your backup | Backups you control | Either works without Recover; Trezor's Multi-share lets you split it. (Trezor) |
| You use DeFi apps or sign token approvals | Readable signing on the device | Both have Clear Signing for supported contracts; neither covers everything. Keep a separate wallet for dApps. (Ledger; Trezor) |
| You can only buy from a marketplace or a local shop | Supply chain | Whichever brand lists that exact seller today. That matters more than the brand. |
We don't pick a winner. Either one, bought from the right place and set up by you, removes the biggest risk most people face: keys sitting on a phone, a laptop or an exchange. Comparing specific models? Our hardware wallet guide is the separate, labeled product page.
Where should I buy a Trezor or a Ledger?
- From the maker first. Trezor: its official shop or Amazon storefront. Ledger: ledger.com. (Trezor; Ledger)
- Otherwise, only from a listed reseller. Check the exact store against Trezor's authorized resellers or Ledger's reseller list. On Amazon, check the "Sold by" name. Trezor: "Never buy a Trezor from an unauthorized third party." (Trezor)
- Never used, open box, returned or "half price." Ledger tells resellers that returned devices "can never be resold in any form." (Ledger)
- Reject any device that arrives set up. A Trezor with firmware already installed "should not be used." Any device with a PIN set or a recovery phrase already filled in is unsafe. (Trezor)
- Then set it up step by step with our hardware wallet setup checklist.
Frequently asked questions
Is Trezor or Ledger safer for beginners?
Neither is clearly safer for a beginner. Current models of both use dedicated security chips and show transactions on the device screen. Beginners lose funds mainly by typing their recovery phrase into a fake site or app, buying from an unlisted seller, or approving transactions they can't read, and those risks are the same on both.
Did the 2026 hardware implant attack affect Trezor?
As of Oct 25, 2026, no. Trezor said there was not a single piece of evidence its devices were compromised and that it had not seen this type of attack on Trezor devices. It is still cutting some resellers from Jan 1, 2027 as a precaution.
Can Ledger see my recovery phrase if I use Ledger Recover?
Ledger says no: the backup is encrypted on the device and split into three pieces held by Coincover, Ledger and EscrowTech, and restoring needs two pieces plus ID checks. Recover is optional and paid. If you never subscribe, nothing is sent.
Does Trezor's open-source code mean it can't be hacked?
No. Open source lets outsiders audit the code and find bugs, but it can't stop you from typing your backup into a phishing site, buying a tampered device, or approving a malicious transaction. Those are the risks to plan around on any brand.
Should I switch from Ledger to Trezor after the CryptoBilis news?
Not just because of the news. If you bought your Ledger from Ledger or a listed reseller and set it up yourself, Ledger says its chip and OS weren't the problem. If you bought from CryptoBilis or another unlisted seller, move funds to a new device from an official source with a new phrase, whichever brand you choose.
What to do next
Comparing Trezor vs Ledger? Buy only from the brand's own store or its listed authorized resellers (Trezor's list, Ledger's list), then set it up with our hardware wallet setup checklist. Comparing devices? Our hardware wallet guide is the separate, labeled product page. Already lost funds to a fake support call or a tampered device? Report the crypto scam in this order.
Get one crypto scam warning a week from Pause Before Send: join the newsletter.
No affiliate links, exchange referrals or coin calls on this page, by policy. We have no affiliate deal with Trezor or Ledger. Store links go to each maker's own reseller list.
Sources
- Trezor, "Security & safety in Trezor" (undated). trezor.io (accessed 2026-10-25)
- Trezor, "Is my device safe to use?" (undated). trezor.io (accessed 2026-10-25)
- Trezor, "Trezor Safe device authentication check" (undated). trezor.io (accessed 2026-10-25)
- Trezor, "Scams and phishing" (undated). trezor.io (accessed 2026-10-25)
- Henry Windle, "Clear Signing comes to Trezor (our flagship security feature of 2026)," Trezor Blog, 2026-09-07. trezor.io (accessed 2026-10-25)
- Trezor Team, "Recent customer data exposed in shipping provider incident," Trezor Blog, 2026-08-13, updated 2026-09-04. trezor.io (accessed 2026-10-25)
- Trezor, "Authorized Resellers" (living page). trezor.io/resellers (accessed 2026-10-25)
- Ledger, "Ledger is 95% OpenSource, why not 100%?," 2024-07-18. ledger.com (accessed 2026-10-25)
- Ledger Donjon, "Genuineness: Threat Model" (undated). donjon.ledger.com (accessed 2026-10-25)
- Ledger, "Ledger Recover" product page and FAQ (living page). ledger.com/recover (accessed 2026-10-25)
- Ledger Academy, "What Is Clear Signing?," 2024-07-17, updated 2026-10-19. ledger.com (accessed 2026-10-25)
- Ledger, "Ongoing phishing campaigns" (living page). ledger.com (accessed 2026-10-25)
- Ledger, "Find a Ledger Reseller around the world" (living page). ledger.com/reseller (accessed 2026-10-25)
- Ledger, "Ledger's Response to the Hardware Implant Attack," 2026-10-15. ledger.com (accessed 2026-10-25)
- Turner Wright, "Trezor reduces resellers as a 'preventative step' amid Ledger tampering reports," Cointelegraph, 2026-10-13. cointelegraph.com (accessed 2026-10-25)
- Jose Antonio Lanz, "Trezor Cuts Its Resellers After Ledger Finds Spy Implant in Crypto Wallets," Decrypt, 2026-10-13. decrypt.co (accessed 2026-10-25)
Method note: every claim above comes from a page we opened on 2026-10-25. We left out prices, coin-support counts and model specs on purpose; this page compares risks, not products. Ledger's 2020 leak figures are sourced on our Is Ledger safe? page. Some Ledger support-center articles wouldn't load for us, so Ledger claims cite Ledger's main site and Ledger Academy instead.
Changelog
- 2026-10-25: First published. Every table row checked against the linked source the same day.