tampered.app
English

tampered.app Ledger

How to check if your Ledger has been tampered with

In October 2026 Ledger confirmed a hardware implant in a device sold by a reseller. The implant doesn’t touch Ledger’s secure chip, so Genuine Check still passes. That’s why all three checks matter.

  1. Official check
  2. Look inside
  3. Where it came from

Step 1

Official check

  1. Download Ledger Wallet (formerly Ledger Live) only from ledger.com. Counterfeit devices have come with modified apps that always report “genuine”.
  2. Connect the device. Genuine Check runs when you first connect it, open the wallet, install an app or update the firmware.
  3. If the check fails, stop. Don’t set the device up, and contact Ledger Support.

What it shows

The secure element is a genuine Ledger chip. At the factory it created a key pair that Ledger signed, and at every check it signs a fresh challenge. (Ledger Donjon)

What it misses

Ledger’s own threat model says it can’t detect physical changes “such as spying implants, if the original Secure Element remains intact”. The 2026 implants work exactly that way: they read the recovery phrase off the screen and send it out over their own cellular modem.

Step 2

Look inside

Compare your board with the chips listed here, then upload photos for an automated check.

ModelMain chipsBatteryReference
Nano X
  • Secure element ST33J2M0
  • Bluetooth processor STM32WB55 / STM32WB35
 Yes Ledger: check hardware integrity (genuine board photos per revision, archived)
Ledger Academy: photos of tampered devices
Nano S Plus
  • Secure element ST33K1M5
  • Microcontroller STM32F042K6U6
 No Ledger: check hardware integrity (genuine board photos, archived)
Ledger Academy: photos of tampered and counterfeit devices
Flex
  • Secure element ST33K1M5
  • Bluetooth processor STM32WB35
 Yes Ledger Academy: photos of tampered devices (incl. a Flex)
Stax
  • Secure element ST33K1M5C
  • Bluetooth processor STM32WB35
  • NFC ST25R3916
 Yes Ledger Academy: photos of tampered devices
Nano Gen5
  • Secure element ST33K1M5
 — Ledger Academy: photos of tampered devices
Nano S · discontinued
  • Secure element ST31H320
  • Microcontroller STM32F042K6
 No Ledger: check hardware integrity (genuine board photos, archived)

Before opening: it voids the warranty. Ledger’s CTO advises backing up your recovery phrase first, because opening can damage the device. If you’ve already lost funds, don’t open it; Ledger asks you to contact law enforcement first.

Board check

Online

  1. Your device

    Pick a brand to see its models.

  2. Photos of the opened board

      Photograph the whole board with the chip markings in focus.

    • Usually 20 to 40 seconds. Photos are never stored.

    Step 3

    Where it came from

    Buy only from Ledger’s own store or a reseller Ledger lists as official. Ledger’s guide to buying safely shows photos of tampered and counterfeit units.

    If you bought from CryptoBilis and haven’t set the device up, don’t set it up; contact Ledger Support. If you already use it, Ledger advises moving your funds to a new device with a new recovery phrase.

    A Ledger never comes with a recovery phrase. If the box contained one, or the device was already set up, don’t use it.

    Sources