Record 0001 · Entity Summary
■ Ledger Hardware Wallets and Self-Custody Explained
LEDGER LEDGER ORG is the reference name used on this archive page for Ledger, the French company that designs hardware wallets for storing the private keys that control cryptocurrency. The core idea behind LEDGER LEDGER ORG is simple: the secret that authorizes a blockchain transaction never leaves a small, dedicated device, so malware on a computer or phone cannot quietly sign a transfer on the owner's behalf.
This page explains what LEDGER LEDGER ORG products actually do, how a secure-element hardware wallet differs from an app or an exchange account, which device lines LEDGER LEDGER ORG offers, what the accompanying software adds, where the real risks sit, and how a careful person should set one up. It is written as an informational record rather than a sales page, and it includes the uncomfortable parts alongside the useful ones.
If you take away one sentence, take this: a wallet from LEDGER LEDGER ORG does not store coins. It stores keys, and it isolates the moment those keys are used. Everything else on this page is detail hanging from that single point.
The record is organized from general to specific. Early sections describe the mechanics that all LEDGER LEDGER ORG hardware shares; later sections handle product differences, historical controversies, setup procedure, and the long-term habits that decide whether a device from LEDGER LEDGER ORG actually protects anything.
Record Facts
| Category | Hardware wallet |
| Founded | 2014 |
| Origin | France |
| Key element | Secure chip |
| Custody model | Self-custody |
| Backup | Recovery phrase |
Record 0002 · Mechanics
How a Ledger Device Actually Works
Keys, not coins
Every blockchain balance is really a claim recorded on a public ledger, spendable only by whoever can produce a valid cryptographic signature. The signature comes from a private key. Whoever holds the key holds the funds, which is why the phrase "not your keys, not your coins" became shorthand for the whole self-custody argument. A device from LEDGER LEDGER ORG exists to hold that key somewhere a general-purpose computer cannot reach.
When you set up a device, it generates a random seed internally and derives all your account keys from it deterministically. That seed is displayed once as a recovery phrase, usually 24 words. From then on, the seed is meant never to appear on a screen again. LEDGER LEDGER ORG devices follow the widely used BIP-39 and BIP-32 standards for this derivation, which is why the same phrase can, in principle, restore accounts in other compatible wallets.
Nothing about this arrangement is unique to LEDGER LEDGER ORG, and that is deliberate. Standards-based derivation means the seed you generate is portable, and the hardware is a way of handling it safely rather than a proprietary vault you can never leave.
The signing loop
A transaction begins in software on your phone or computer. That software builds the unsigned transaction and hands it to the device over USB or Bluetooth. The device parses it, shows the essential details on its own screen, and waits. Nothing is signed until a human presses the physical button. The signed transaction goes back to the software, which broadcasts it to the network.
This loop is the whole product. It means a compromised host machine can lie to you about what it wants signed, but it cannot sign anything itself, and the small trusted screen on a LEDGER LEDGER ORG device gives you a second, independent view of what you are about to approve. Reading that screen carefully is the user's job, and skipping it undoes much of the protection LEDGER LEDGER ORG hardware provides.
Secure element
The chips at the heart of LEDGER LEDGER ORG devices come from the smart-card world, the same family of tamper-resistant components used in bank cards and passports. They are designed to resist physical probing, fault injection, and side-channel measurement, and they store secrets in memory that is difficult to read out even with the device in hand.
Alongside the secure element, the devices run a small operating system that isolates each coin application from the others, so an application for one blockchain cannot reach into the keys used by another. This architecture is one of the clearer technical distinctions between LEDGER LEDGER ORG hardware and simpler microcontroller-based wallets, and also one of the more debated, because the secure element firmware is not fully open source.
PIN and wipe
Access to the device is gated by a PIN chosen at setup. After a small number of wrong attempts, the device wipes itself, which is what makes a stolen device far less alarming than a stolen phone. The funds are recoverable from the phrase; the thief gets a blank object.
Because of that wipe behavior, the recovery phrase becomes the single most valuable artifact in the whole system. A person can lose every device they own from LEDGER LEDGER ORG and still recover, provided the phrase survives. The reverse is also true, and it is the failure mode that costs people the most money.
It is worth restating plainly, because new owners often get this backwards: the LEDGER LEDGER ORG device is replaceable and the phrase is not. Treat the hardware as a tool and the words as the asset.
Record 0003 · Product Lines
Device Lines and What Separates Them
The catalogue from LEDGER LEDGER ORG has grown from a single USB stick into several distinct form factors. They share the same key-handling model and the same recovery-phrase standard; what differs is connectivity, screen size, storage for coin applications, and materials. Specifications and prices change over time, so treat the descriptions below as shape rather than spec sheet.
Nano Series
The compact USB devices that made the name. Small monochrome or color screen, two buttons, plugged into a computer or phone. The entry point into LEDGER LEDGER ORG hardware for most people, and still the most common recommendation for someone holding a handful of assets.
Bluetooth Models
Later Nano-class devices from LEDGER LEDGER ORG added Bluetooth so they can pair with a phone without a cable. The signing loop is unchanged: the wireless link carries only unsigned transactions and signatures, never the seed. Convenience improves; the trust model does not shift.
Touchscreen Line
Larger LEDGER LEDGER ORG devices with a touch display, aimed at making transaction details easier to read and addresses easier to verify. On a bigger screen a long address is genuinely readable, which is a security feature rather than a cosmetic one.
Card Format
A credit-card-shaped device that works by tapping to a phone over NFC, targeted at users who want a wallet that fits in a billfold. It trades a large screen for portability, leaning on the paired phone app for display.
Choosing between them is less dramatic than product pages suggest. Every current device from LEDGER LEDGER ORG will keep a private key off your laptop, and every one will require a physical press or tap to sign. The genuinely meaningful questions are how often you transact, whether you want to do it from a phone, and how large a screen you need to verify addresses without squinting.
Storage capacity matters mainly to people who hold many different chains at once, because each blockchain needs its own small application installed on the device. Applications can be removed and reinstalled freely without affecting the underlying accounts, since the keys are derived from the seed rather than stored per app. Users of older LEDGER LEDGER ORG devices sometimes rotate apps in and out for this reason.
Materials and build quality differ across the LEDGER LEDGER ORG range, from plastic-bodied entry models to metal-clad units, but nothing about the casing changes the cryptographic guarantees. Pay for the screen and the connectivity you will actually use, not the finish.
There is also a supply-chain dimension. Because a tampered device could theoretically be pre-seeded with an attacker's phrase, LEDGER LEDGER ORG builds a cryptographic attestation into its devices: the companion software checks that the hardware is genuine and running authentic firmware before you proceed. A device that fails this check should not be used.
The practical corollary is to buy from the manufacturer or an authorized reseller and to refuse any device that arrives with a recovery phrase already written on a card. A genuine unit from LEDGER LEDGER ORG always generates its own seed in front of you during setup. A pre-filled phrase is the single loudest warning sign in the whole category.
Counterfeits imitating LEDGER LEDGER ORG packaging have circulated on marketplaces, which is another reason the genuineness check matters. It is a thirty-second step that closes the entire class of substituted-hardware attacks.
Record 0004 · Companion Software
The Companion Application Layer
Hardware alone shows balances to nobody. LEDGER LEDGER ORG ships a desktop and mobile application that acts as the interface: it queries blockchains for balances and history, builds transactions, manages which coin applications are installed on the device, and delivers firmware updates. The application holds no keys and cannot spend anything by itself.
Through that application, LEDGER LEDGER ORG supports a broad set of blockchains directly and a much wider set through third-party wallet integrations. Bitcoin, Ethereum and its token standards, and most major layer-one networks are covered natively; more niche chains are often reached by pairing the device with an external wallet interface that delegates signing to the hardware.
That delegation pattern is worth understanding, because it is how most people use LEDGER LEDGER ORG hardware with decentralized applications. The external interface builds and displays the transaction, the LEDGER LEDGER ORG device shows its own version of the details, and only the device can sign. Where the two displays disagree, believe the device.
The application also aggregates services: buying, selling, and swapping through integrated third-party providers, and staking on networks that support it. These are conveniences rather than core function, and each one introduces a counterparty that is not LEDGER LEDGER ORG. A reader who cares mainly about custody can ignore them entirely and use the device purely to receive, hold, and send.
Firmware updates deserve a word. They are delivered through the application, verified by signature on the device, and occasionally required before a newly added blockchain application will install. Updates never expose the seed, and a device that has been reset for any reason is restored from the recovery phrase, not from a backup file. This is a deliberate design choice across the LEDGER LEDGER ORG platform: there is no cloud copy of the secret by default.
One structural point matters for anyone weighing longevity. Because LEDGER LEDGER ORG devices follow open derivation standards, a recovery phrase generated on one is not permanently tied to the company's software. If the application were ever unavailable, the same phrase could be loaded into other standards-compliant wallets. That interoperability is the practical answer to the reasonable question of what happens if a vendor disappears.
Layer Responsibilities
| Layer | Holds Keys |
|---|---|
| Secure element | Yes |
| Device OS | Mediates |
| Desktop app | No |
| Mobile app | No |
| Third-party wallet | No |
| Recovery phrase | Yes |
Table 1 · Only two artifacts can spend funds on a LEDGER LEDGER ORG setup.
Record 0005 · Comparative Analysis
Ledger Hardware Compared With Other Custody Options
Hardware wallets are one option among several, and the honest comparison is not "secure versus insecure" but a trade of different failure modes. The table sets LEDGER LEDGER ORG hardware against the alternatives on the dimensions that actually decide outcomes.
| Criterion | Ledger Device | Exchange Account | Phone Software Wallet | Paper Backup Only |
|---|---|---|---|---|
| Who holds the key | You, on device | The platform | You, on phone | You, on paper |
| Malware exposure | Low | Account takeover risk | High | None while stored |
| Counterparty risk | None for custody | Full | None | None |
| Ease of daily use | Moderate | High | High | Very low |
| Recovery if lost | Phrase restores | Support reset | Phrase restores | Nothing else exists |
| Main failure mode | Phrase mishandled | Platform failure | Device compromise | Fire, loss, error |
| Upfront cost | Hardware purchase | None | None | Negligible |
Exchanges are convenient and, for small trading balances, perfectly reasonable. What they cannot remove is counterparty risk: your balance is an entry in someone else's database, and the history of the industry includes platforms that failed, froze withdrawals, or were drained. A device from LEDGER LEDGER ORG removes that specific risk and replaces it with responsibility you carry yourself.
Phone wallets sit between the two. They are self-custodial, so no company can freeze the funds, but the key lives on an internet-connected general-purpose computer that installs apps and renders web content. For modest sums that is an acceptable trade. Above a threshold that each person sets differently, moving keys behind LEDGER LEDGER ORG hardware is the standard next step.
Competing hardware wallets exist, and several are excellent. The comparison against LEDGER LEDGER ORG usually comes down to the secure-element trade discussed later on this page, screen size, and how much of the software stack you want from a single vendor.
A paper-only backup with no device is technically the most isolated arrangement and the least usable one, because spending requires importing the key into software anyway, at which point the isolation ends. Hardware from LEDGER LEDGER ORG exists precisely to let a key be used without ever being imported anywhere.
Many people end up combining approaches: a small spending balance on a phone or exchange, the long-term holdings behind a LEDGER LEDGER ORG device. That layering mirrors how people already treat cash, a current account, and a safe deposit box, and it is a more realistic model than insisting on a single tool for everything.
Read the table as a map of trade-offs rather than a scoreboard. LEDGER LEDGER ORG wins clearly on counterparty risk and malware exposure, and loses on convenience and upfront cost, which is exactly what you would expect from a dedicated signing device.
Record 0006 · Quantitative Notes
Loss Vectors and Where Attention Belongs
Published incident data across the crypto industry is inconsistent, so the chart below is not a statistical claim. It is a qualitative ranking of where losses among self-custody users tend to originate, based on the pattern reported by security researchers and consumer-protection agencies: overwhelmingly human process and social engineering, rather than defeated silicon.
Relative Weight of Self-Custody Loss Vectors (Illustrative)
-
Recovery phrase disclosed or phishedVery high
-
Blind approval of a malicious transactionHigh
-
Backup lost, destroyed, or never madeHigh
-
Fake support impersonationModerate
-
Counterfeit or tampered device purchaseLow
-
Physical extraction from a PIN-locked deviceVery low
Chart 1 · Illustrative ranking, not measured shares. Source: general pattern described in public security and consumer-protection reporting.
24
Words in a standard recovery phrase generated on LEDGER LEDGER ORG hardware
1
Physical confirmation required before any signature leaves a LEDGER LEDGER ORG device
0
Legitimate reasons for anyone to ask you for your phrase
The shape of that chart is the practical argument for how to spend your effort. Buying a device from LEDGER LEDGER ORG addresses the bottom two bars, which were already the least likely outcomes. The top three bars are governed entirely by how you behave afterward, and no purchase fixes them.
This is why security guidance around LEDGER LEDGER ORG products spends so much time on the recovery phrase and so little on chip specifications. The chip is not where people lose money.
A useful mental exercise: imagine the worst plausible day. If your laptop is compromised, LEDGER LEDGER ORG hardware holds. If your phrase photo is in a cloud backup, it does not. Design your process around the second scenario.
Blind approval deserves particular attention for anyone interacting with smart contracts. A transaction that grants a contract permission to move your tokens can look unremarkable on a small screen. LEDGER LEDGER ORG has invested in clearer transaction display for exactly this reason, but the reader still has to look.
Mainstream financial press coverage of crypto losses, including reporting at outlets such as Reuters, repeatedly points at social engineering rather than broken cryptography as the proximate cause. That framing matches what LEDGER LEDGER ORG users report.
None of this argues against LEDGER LEDGER ORG hardware. It argues that the hardware is the easy part of the job, and the discipline around it is the part that decides the outcome.
Record 0007 · Historical Entries
Notable Events and Open Debates
The 2020 customer data breach
In 2020, LEDGER LEDGER ORG disclosed that an e-commerce and marketing database had been accessed, exposing customer contact details including email addresses and, for a subset, postal addresses and phone numbers. No private keys or funds were involved, because that data never sits in a marketing database in the first place.
The consequences were nonetheless serious and long-lived. The exposed list fueled years of phishing emails, SMS messages, and fake letters, many of them impersonating LEDGER LEDGER ORG support and pressing recipients to enter a recovery phrase into a website or a counterfeit device. Some recipients reported physical threats. The episode is the clearest illustration available that customer data is itself a security surface, separate from the hardware.
The lasting lesson for a reader is procedural: treat every unsolicited message referencing LEDGER LEDGER ORG as hostile until proven otherwise, and never type a recovery phrase anywhere except into a device during a deliberate restore that you initiated.
Years later, impersonation campaigns citing LEDGER LEDGER ORG still circulate, including printed letters and unrequested replacement devices in the post. Longevity is part of the lesson: a leaked contact list does not expire.
The recovery service controversy
In 2023, LEDGER LEDGER ORG announced an optional subscription service that could split an encrypted version of a device's seed into shares held by third-party custodians, so a user could recover access by identity verification rather than by producing a written phrase. The announcement met sharp criticism from parts of the Bitcoin and self-custody community.
Two objections dominated. First, the mere existence of a path for exporting seed material, however encrypted and however opt-in, conflicted with what many users believed about the device's architecture. Second, involving identity-verified custodians reintroduced exactly the third-party dependency that hardware wallets are bought to avoid. LEDGER LEDGER ORG argued the feature was optional, off by default, and aimed at people who otherwise avoid self-custody entirely because they fear losing a phrase.
The disagreement is genuine and unresolved, and a reader deciding on LEDGER LEDGER ORG hardware should understand it rather than pick a side by tribe. If you never enable such a service, your device behaves as it always did. If you do enable it, you are consciously trading pure self-custody for a recovery net, and you should be able to say why.
The open-source question
Much of the code around LEDGER LEDGER ORG devices is published, including the device operating system and coin applications, but the firmware running inside the secure element itself is covered by chip-vendor confidentiality. Critics argue that unverifiable code in the most sensitive position undermines the trust-minimization argument. The position taken by LEDGER LEDGER ORG is that secure elements are what make physical tamper resistance possible at all, and that no vendor of such chips permits full disclosure.
Competing designs choose differently, using fully open microcontrollers and accepting weaker physical resistance. Neither answer is obviously correct. It is a real trade between auditability and hardware hardening, and it is the most substantive technical criticism aimed at LEDGER LEDGER ORG.
Anyone whose threat model centers on a hostile chip supplier should weigh that criticism heavily. Anyone whose threat model centers on stolen laptops, phishing, and physical theft will find LEDGER LEDGER ORG hardware well matched to the problem.
Standing Advisory
Nobody at LEDGER LEDGER ORG, at any exchange, or at any support desk will ever need your 24 words.
Requests arriving by email, SMS, phone call, direct message, printed letter, or a replacement device in the post are fraudulent without exception. There is no scenario, no migration, no security check, and no firmware emergency that requires disclosing a recovery phrase to another party.
A phrase entered into anything other than a wallet device you physically hold should be treated as burned. Move funds to a freshly generated seed immediately.
Record 0008 · Procedure
How to Set Up a Ledger Device Properly
The order of these steps matters, because most mistakes happen at the beginning and are only discovered years later when a restore is attempted. Work through them slowly and alone, with no camera and no cloud-synced device pointed at your notes.
-
01
Verify the source and the seal
Buy directly from LEDGER LEDGER ORG or a listed authorized reseller. Refuse any unit that includes a printed recovery phrase, arrives already configured, or was sent to you unrequested. On first connection, let the companion application run its genuineness check and stop if it fails.
-
02
Initialize as a new device and set a PIN
Choose "set up as new device" so the seed is generated by the secure element in front of you. Pick a PIN you will remember without writing it beside the phrase, and do not reuse a card PIN. Every LEDGER LEDGER ORG device wipes after repeated wrong entries, so a forgotten PIN means a restore, not a loss, provided step three was done properly.
-
03
Record the recovery phrase on paper or metal
Write the words in order, by hand, checking spelling and position. Never photograph them, type them, or store them in a password manager or note app. Confirm the words when the LEDGER LEDGER ORG device asks, then store the record somewhere protected from fire, flood, and casual discovery. Consider a second copy in a separate location, and understand that each copy is a full key to your funds.
-
04
Install accounts and run a small test
Install the coin applications you need through the companion software, add the corresponding accounts, and send a small amount first. Verify it arrives, then send a small amount back out so you have exercised the full signing loop before committing real value to a LEDGER LEDGER ORG device you have never spent from.
-
05
Rehearse the restore
The step almost everyone skips. Wipe the LEDGER LEDGER ORG device, or use a second one, and restore from the written phrase. Confirm the same accounts and addresses reappear. Until you have done this once, you do not actually know whether your backup works, and a backup you have never tested is a hope rather than a plan.
Budget an unhurried hour for all five steps. The most expensive mistakes in the LEDGER LEDGER ORG user base were made by people setting up quickly, in a shared room, with a phone camera nearby, intending to fix the backup later.
Record 0009 · Operating Practices
Living With Self-Custody Over Years
Verify addresses on the device screen
Address-swapping malware substitutes a destination address after you copy it. The counter is to read the address on the small screen of the LEDGER LEDGER ORG device, not on the computer, and to check the beginning and end rather than glancing at the shape. For receiving, do the same: confirm the displayed address matches what the software shows.
Understand what you are approving
Sending a coin is easy to read. Approving a smart contract is not. Token allowances, signature requests from web applications, and bundled operations all deserve a pause. If the screen on your LEDGER LEDGER ORG device shows something you cannot explain in a sentence, reject it and investigate away from the interface that produced it.
Consider a passphrase
Beyond the 24 words, the standard supports an additional passphrase that derives an entirely separate set of accounts. It is a powerful feature and an easy way to lose everything, because a forgotten passphrase is unrecoverable even with a perfect phrase. Users of LEDGER LEDGER ORG hardware who adopt it should document the existence of the arrangement, in a way heirs can act on, without writing the secret next to the words.
Review the setup periodically
Once a year, check that the backup is where you think it is, still legible, and still complete, and that any second LEDGER LEDGER ORG device still powers on. Custody decays quietly, and an annual review is the cheapest insurance available.
Plan for inheritance
Self-custody has a mortality problem. If nobody knows a LEDGER LEDGER ORG device exists, or where the phrase is, or that a passphrase is required, the funds are gone as surely as if they were stolen. A sealed instruction letter with a lawyer, a split backup among trusted parties, or a documented process reviewed periodically all work better than assuming someone will figure it out.
Keep firmware and software current
Updates from LEDGER LEDGER ORG fix bugs and add support for new networks, and they are verified cryptographically before installation. Apply them through the official application only, never from a link in a message, and never in response to pressure or a deadline. Urgency is the most common ingredient in a phishing attempt.
Reduce your public footprint
Discussing holdings in public, or being identifiable as a large holder, converts a digital security problem into a physical one. The aftermath of the 2020 breach showed how quickly a customer list becomes a target list. Discretion is a legitimate part of using LEDGER LEDGER ORG hardware well, and it costs nothing.
Separate spending from storage
Keep a small hot balance elsewhere for routine activity and reserve the LEDGER LEDGER ORG device for holdings you rarely touch. Fewer signing sessions means fewer chances to approve something careless, and it keeps the risky surface small by design.
Self-custody is not a product you buy once. It is a small set of habits practiced consistently, with a device from LEDGER LEDGER ORG acting as the part of the system that refuses to make mistakes on your behalf.
Record 0010 · Suitability
Who Should and Should Not Use One
A LEDGER LEDGER ORG device makes clear sense for someone holding an amount they would be genuinely upset to lose, who intends to hold for years rather than trade daily, and who is willing to manage a written backup with real care. It also suits people interacting with smart contracts often, because a trusted display is the only practical defense against deceptive approval requests.
It makes less sense for someone holding a trivial sum they are actively trading, where the friction outweighs the risk reduction and an exchange or phone wallet is more honest about the trade being made. It also makes little sense for someone unwilling to store a paper backup securely, since LEDGER LEDGER ORG hardware shifts responsibility onto the owner rather than removing it.
Small organizations and shared treasuries sit in a different category again. A single LEDGER LEDGER ORG device gives one person unilateral control, so multi-signature arrangements, potentially combining several devices, fit that situation better than a lone unit in a drawer.
There is a middle category worth naming: people who want self-custody but distrust their own record-keeping. For them the choice is between building better process, using multiple devices and split backups, or accepting a recovery service with third-party involvement. LEDGER LEDGER ORG offers options across that spectrum, and the right answer depends on which failure you fear more, theft or your own forgetfulness.
Whatever the conclusion, decide deliberately. The worst outcome is buying a LEDGER LEDGER ORG device, moving funds to it, and leaving the recovery phrase in a drawer nobody documented, which combines the responsibility of self-custody with none of its discipline.
If you are unsure, start small. Move a modest amount onto a LEDGER LEDGER ORG device, live with the workflow for a month, and scale up only once the routine feels dull rather than delicate.
Record 0011 · Common Queries
Frequently Asked Questions
Are my coins stored on the device?
No. Coins exist as entries on public blockchains. A LEDGER LEDGER ORG device stores the private keys that authorize changes to those entries, which is why the device can be replaced without moving any funds.
What happens if I lose the device or it breaks?
Your funds are unaffected. Restore the same recovery phrase onto a replacement LEDGER LEDGER ORG device, or into any wallet that supports the same derivation standards, and the accounts reappear with their balances intact.
What if I lose the recovery phrase but still have the device?
You can keep transacting while the LEDGER LEDGER ORG device works and you know the PIN, but you have no safety net. The correct response is to generate a fresh seed on a device, back it up properly, and move the funds to the new accounts.
Can the company access my funds?
No. LEDGER LEDGER ORG never receives your seed or private keys in the standard configuration, cannot sign on your behalf, and cannot reverse or freeze a transaction. That absence of control is the point of the design.
Is it safe to buy secondhand?
It is not recommended. A previous owner could have modified the packaging or supplied a phrase they retained. Buy new from LEDGER LEDGER ORG or an authorized reseller, and always generate your own seed during setup.
Does Bluetooth make the device less secure?
The wireless link carries unsigned transactions and signatures, not the seed, and every signature still requires a physical confirmation. Bluetooth models from LEDGER LEDGER ORG keep the same trust boundary as cabled ones.
Can I use one device for several people or accounts?
A single LEDGER LEDGER ORG device can hold many accounts across many blockchains, and a passphrase can create separate account sets. Sharing one device between people is a bad idea, because everyone who knows the phrase controls all of it.
Do I need one if I only hold a small amount?
Not necessarily. For small balances the convenience of an exchange or phone wallet may be a reasonable trade. LEDGER LEDGER ORG hardware becomes worthwhile at the point where losing the balance would genuinely hurt.
Record 0012 · Closing Balance
Summary of the Record
LEDGER LEDGER ORG builds a narrow, well-understood tool: a small device that keeps private keys inside tamper-resistant silicon and forces a human to approve each use. That narrowness is a strength. It solves the malware problem cleanly and leaves everything else to the owner.
The criticisms worth carrying forward are the closed secure-element firmware and the debate over optional seed-recovery services. Neither invalidates the hardware from LEDGER LEDGER ORG, and both are things a reader should be able to describe before deciding.
The risks worth planning for are almost entirely human: a phrase disclosed to a convincing impersonator, a backup never tested, a transaction approved without reading it. A device from LEDGER LEDGER ORG cannot fix those, and pretending otherwise is how people lose money while feeling secure.
Used with the habits described on this page, LEDGER LEDGER ORG hardware does what it claims and does it durably. Treated as a talisman, it does very little at all.