Review
Ledger Flex
Popular hardware wallet, but you have to trust closed-source firmware
Our Verdict
The hardware is polished and the mobile app is a strong pick. Our hesitation is about trust. Ledger's firmware is closed-source, so no outside researcher can verify what the device actually does with your keys - you have to take the company's word for it. The 2023 Recover announcement prompted a lot of discussion about that trust. Add three customer-data exposures that Ledger disclosed and a December 2023 supply chain incident, and the trust questions stack up. We still think it is a reasonable pick for a casual holder, but it is not our top choice.
What we like
- Strongest Secure Element chip (EAL6+, ANSSI certified - unique in market)
- E-ink touchscreen display
- Strong mobile app (Ledger Live)
- Bluetooth connectivity for mobile use
- Wide third-party app ecosystem
- 6.5M+ units sold - largest install base
What could be better
- Closed-source firmware - cannot be independently verified
- Premium price ($249) plus optional $9.99/mo Recover subscription
- Three customer data exposures (2020 breach, Shopify incident, 2026 Global-e)
- December 2023 Connect Kit supply chain attack ($600K stolen)
- Supports altcoins (broader attack surface)
How We Scored This
Community score compiled from Reddit threads, expert reviews, and app store ratings.
The Recover announcement generated a large discussion thread, with users comparing it with other hardware wallets.
Ledger is discussed frequently on r/Bitcoin, with threads on closed-source firmware and self-custody.
Over 1 million customer emails and 272,000 physical addresses leaked. Led to phishing campaigns and physical threats against users. Ledger acknowledged and published a post-mortem.
In a post dated 13 January 2021, Ledger said Shopify notified it on 23 December 2020 that rogue members of Shopify's support team had exported customer transaction records in April and June 2020, affecting approximately 292,000 Ledger customers. The exposed data included email, name, postal address, products ordered and phone number.
Malicious code injected into the Ledger Connect Kit NPM package, draining $600K from DeFi users. Affected third-party dApps, not Ledger devices directly - but damaged ecosystem trust.
Ledger confirmed on 5 January 2026 that customer names and contact details were exposed via its payments partner Global-e. Recovery phrases, private keys and PINs were not involved.
App itself receives reasonable ratings (4.1/5 on iOS). Common praise: clean interface, easy to buy/sell. Common complaints: customer support, sync issues, and "why does a hardware wallet need a subscription?"
As an Amazon Associate, we earn from qualifying purchases. No extra cost to you.
Score History
Switched to aggregated community scoring model. Community score (11/25) reflects community reaction to the Recover announcement and the disclosed data exposures. Review published.
Initial research scores for Security, Fees, Trust.
Related Reviews
Explore more Bitcoin product reviews
Newsletter
Bitcoin insights, no noise.
Bitcoin explained without the hype. Updates when they matter.