Avoid Ledger and their Complies Sanction Crap!

[dkbit98]

I have seen many stupid things coming from ledger in the past, but here is another big reason why everyone should avoid all hardware wallets coming from their factory.
Few days ago ledger publicly released a page claiming they are in full Complies with Sanctions!
That basically mean they are going to implement compliance measures to prevent transactions involving sanctioned countries, entities, individuals and wallet addresses, and they are masking this as user protection  

As a temporary measure you should STOP using ledge live spyware cr-app, but I would suggest switching to different hardware wallets.

If we detect an attempt to interact with a sanctioned wallet address or linked to a sanctioned wallet address, your transaction will not be initiated.

As part of Ledger’s compliance measures, access to Ledger’s products and services is restricted based on IP address and is not available in areas under comprehensive sanctions or in certain locations due to local regulations.

https://support.ledger.com/article/Why-Ledger-Complies-with-Sanctions

[Charles-Tim]

I know Ledger will do something that will not disappointed about them again and this is another one. Maybe in the next 1 or two years, they will come up with another thing again. Or maybe they will come up with it within months.

From sending seed phrase online to different companies to supporting sanctioning. I have posted before that if Ledger Nano is only the hardware wallet that is remaining on this earth, that I will never use a hardware wallet.

[Mia Chloe]

I have seen many stupid things coming from ledger in the past, but here is another big reason why everyone should avoid all hardware wallets coming from their factory.
Few days ago ledger publicly released a page claiming they are in full Complies with Sanctions!

Basically I'm not surprised about this actually because I know it's definitely something they will eventually pull off. Ledger became more of a disappointment when they out of the blue decided to add cloud storage for seed phrases and private keys (which makes no sense) . I wouldn't even be surprised to hear all of a sudden that the government controls that cloud.

Sadly people will still use it and some people just can't do without centralization worse, some even believe it's better and more beneficial.

[Charles-Tim]

Basically I'm not surprised about this actually because I know it's definitely something they will eventually pull off. Ledger became more of a disappointment when they out of the blue decided to add cloud storage for seed phrases and private keys (which makes no sense) . I wouldn't even be surprised to hear all of a sudden that the government controls that cloud.

They were not careful with customers privacy before. If you were one of the people that bought their wallet directly from their company in the past before thier users email, addresses like home and office addresses were compromised, you would hate the company more.

The reason I did not like Ledger Nano has been from the start even when some people recommended the wallet. The reason was that and it is still that it is a close source wallet. Ledger Live is open source but the hardware secure element is close source.

[Meuserna]

Ledger is poison.

Using closed source code to secure your Bitcoin is making a deal with the devil.  It's dangerous.  Bitcoin is open source.  Your wallet should be too.

We were warned about all of this long ago:

"If you are a Recover user and have your shard into safeguarded by third parties, then yes, a government could subpoeana them and get access to your funds."

"Using Recover gives you an easy recovery option and mitigates backup loss, but your assets could get frozen by the government"

SOURCE

Note: Even if you don't use Recover, the code required to enable key extraction is on your Ledger device.  Don't be surprised if Ledger announces compliance for government access to that API.

Ledger is poison.

[PX-Z]

. Maybe in the next 1 or two years, they will come up with another thing again. Or maybe they will come up with it within months.

They will end up no customers on that period of time in two years or so if they continues with practices that contradict the core principles of cryptocurrency and transparency. And now they can be used by government as dogs of course with privacy and limit using those device? Well, that's a pretty good continuing step to lose their user base.

[Meuserna]

. Maybe in the next 1 or two years, they will come up with another thing again. Or maybe they will come up with it within months.

They will end up no customers on that period of time in two years or so if they continues with practices that contradict the core principles of cryptocurrency.

I wish you were right, but there are faaaaaaar more crypto-bros than there are educated Bitcoin holders.  Crypto-bros only care about moonz and gainz.  They care far more about trendy gadgets than they care about security.  They don't even understand the basics.  Ledger realized those guys were easy targets sometime around 2020 and they started aggressively marketing to them.  Interestingly, that's when Ledger's marketing color scheme went from white to black.  Ironic, eh?  No, not at all.  Ledger went to the dark side.

The most low-information Bitcoiners use hot wallets.  The next-lowest-information Bitcoiners use Ledger (and Tangem).

As proof of what I mean, go on any Ledger forum.  You'll find idiots who praise Ledger for being closed source.  Yikes.

Bitcoin ownership hasn't gone mainstream yet, so Ledger will have no shortage of low-information people to market their trash to.

[PX-Z]

I wish you were right, but there are faaaaaaar more crypto-bros than there are educated Bitcoin holders.  Crypto-bros only care about moonz and gainz.  They care far more about trendy gadgets than they care about security.  They don't even understand the basics.  Ledger realized those guys were easy targets sometime around 2020 and they started aggressively marketing to them.  Interestingly, that's when Ledger's marketing color scheme went from white to black.  Ironic, eh?  No, not at all.  Ledger went to the dark side.

Ah, the fanatics and collectors, been there done that lol. Until i suffered from those data breach, received tons of spam emails and even calls asking for crypto opinions lmao. I used to be an affiliate providing sales to them and earning thousand of euros when the Ledger X were introduced, then different variation comes and colors of nano, and custom made of X.  Until i received at least 2 different non working device which is a waste of time asking to their CS for replacement and refund.

[satscraper]

That basically mean they are going to implement compliance measures to prevent transactions involving sanctioned countries, entities, individuals and wallet addresses, and they are masking this as user protection  

This is just the jumpscare because, technically, such blocking is possible if users rely onL edger's own servers to send transactions, which means using Ledger Live app. If users use other nodes and apps, this is not an issue. Therefore, those under sanctions need not worry.

That said, I agree it’s better to switch to another wallet rather than continue using Ledger devices ^{not because of sanctions, but due to security concerns}.

[Polkat]

Their last sentence sounds very cynical:

By adhering to these regulations, we not only protect our users but also maintain the trust and reputation of our platform in the rapidly evolving crypto and digital asset landscape.

[Forsyth Jones]

That basically mean they are going to implement compliance measures to prevent transactions involving sanctioned countries, entities, individuals and wallet addresses, and they are masking this as user protection  

This is just the jumpscare because, technically, such blocking is possible if users rely onL edger's own servers to send transactions, which means using Ledger Live app. If users use other nodes and apps, this is not an issue. Therefore, those under sanctions need not worry.

That said, I agree it’s better to switch to another wallet rather than continue using Ledger devices ^{not because of sanctions, but due to security concerns}.

It's scary. I almost couldn't believe it when I saw this news. Bitcoin is neutral when it comes to transactions. Bitcoin doesn't ask for your name, check your documentation, or check whether your name is registered with OFAC before making a transaction. However, Ledger is going against Satoshi Nakamoto's principles. He created Bitcoin to be neutral.

Furthermore, it seems that the restriction imposed only applies to Ledger Live, but what guarantees me that in the future, some government will pressure Ledger to censor users or even seize funds from users who interact with sanctioned addresses or those with a high AML score? Who knows, maybe this is the real purpose of ledger recover?

Can you understand how dangerous this is?

However, if I connect my Ledger to a random Electrum server or even use my own server, Ledger won't have the power to censor transactions.

But what stops a third-party server from doing the same? That's why it's important to run your own full node and broadcast your own transactions.

[dkbit98]

I know Ledger will do something that will not disappointed about them again and this is another one. Maybe in the next 1 or two years, they will come up with another thing again. Or maybe they will come up with it within months.

They are champions in  making a bad decisions.
It would not surprise me to see them working with government for some CBDC supported deveices in future  

Note: Even if you don't use Recover, the code required to enable key extraction is on your Ledger device.  Don't be surprised if Ledger announces compliance for government access to that API.

Sure.
Full compliance until death of ledger.
Let's rename ledger to LENIN wallet.

This is just the jumpscare because, technically, such blocking is possible if users rely onL edger's own servers to send transactions, which means using Ledger Live app.

Everyone is forced to use ledger live at least one time, and even more because they need to update firmware^spyware? for their devices.

[Meuserna]

Bitcoin is neutral when it comes to transactions. Bitcoin doesn't ask for your name, check your documentation, or check whether your name is registered with OFAC before making a transaction. However, Ledger is going against Satoshi Nakamoto's principles. He created Bitcoin to be neutral.

Furthermore, it seems that the restriction imposed only applies to Ledger Live, but what guarantees me that in the future, some government will pressure Ledger to censor users or even seize funds from users who interact with sanctioned addresses or those with a high AML score? Who knows, maybe this is the real purpose of ledger recover?

Can you understand how dangerous this is?

Let's talk about that.

Here are some quotes on the subject, taken from a Youtube video interview with Ledger CEO Pascal Gauthier:

Rodolfo Novak: "Isn't it an issue now that you have the KYC plus the Bitcoin, together?  Right, because just losing the KYC...  it's a problem, it sucks, right?  But you don't lose the Bitcoin.  Now, (because of Ledger Recover) you have the KYC plus the coins."

Pascal Gauthier: "...so?"

SOURCE

"So?" makes it very clear that Ledger either doesn't understand how dangerous this is, or Ledger doesn't care.

Ledger's CEO even said, if you care about your privacy, don't use Ledger Recover:

"If, for you, your privacy is of the utmost importance, please do not use that product, for sure."

SOURCE

...but here's what he didn't say:  The code required for key extraction from Ledger devices is part of Ledger's firmware.  It's baked in.  And the firmware is closed source, so there's no way to prove it can't be accessed remotely by Ledger, their partner companies, or hackers.

Can't prove it?

Can't trust it.

One of Ledger's founders even said:

"There's no backdoor and I obviously can't prove it"

SOURCE

He can't prove it because their code is closed source.  Trezor, ColdCard, Jade, Seedsigner, and Krux can all prove what their code does, because every line of their code is published and verifiable.  Ledger can't because theirs isn't.

It gets worse though.

Ledger Recover involves other companies.  What happens if those companies are asked by a government to give access to your keys?  Here's what Ledger's CEO says:

"These companies are not slaves to Ledger.  We just have commercial agreement."

-- Ledger CEO Pascal Gauthier

SOURCE

"Great, so now the Department Of Justice calls you and says "We are charging so and so with X, Y and Z.  Get two of your vendors to send us the Bitcoin keys."

-- Harry Sudock

SOURCE

The more you think about it, the more you'll realize that Ledger's key extraction scheme is poison.  And since Recover is baked into their closed source firmware, it means Ledger's firmware is poison.

Here's a question I have yet to see anybody ask:  What if a government asks Ledger to use Recover to extract the keys of a Ledger user who doesn't subscribe to Recover?  The capability is on their Ledger device whether they subscribe to Recover or not.

"I said government could get access to the backups of a user, as it's only a matter of law and is about one user"

-- murzika, Ledger Co-Founder, Former CEO, and Former Chairman

SOURCE

"If you are referring to Ledger Recover, a joint government task force could access a user's recovery backup. I mean it's just a question of law, two shards could be subpoaned even if they are each in a different jurisdiction."

-- murzika, Ledger Co-Founder, Former CEO, and Former Chairman

SOURCE

...but, again, I need to point out that the capability is built into the firmware regardless of whether or not the user subscribes to Recover.  I see no reason why a government can't force access to a user's device, since remote access to the device is baked into Ledger's firmware.

This goes back to what you said:

Can you understand how dangerous this is?

Absolutely.  Ledger's closed source code is very dangerous.

Most people haven't even begun to think through the implications of having remote access to the user's keys baked into the firmware on the hardware wallet.

[m2017]

That basically mean they are going to implement compliance measures to prevent transactions involving sanctioned countries, entities, individuals and wallet addresses, and they are masking this as user protection  

Almost any "sh1t" in the world is disguised as protection for citizens users.

As a temporary measure you should STOP using ledge live spyware cr-app, but I would suggest switching to different hardware wallets.

Why only as a temporary measure? I think it's obvious, if your transactions can potentially be blocked, then such devices/apps should not be used. Ever.

If we detect an attempt to interact with a sanctioned wallet address or linked to a sanctioned wallet address, your transaction will not be initiated.

So this is what "free bitcoin" looks like in their understanding? Thanks, but we don't need that.

As part of Ledger’s compliance measures, access to Ledger’s products and services is restricted based on IP address and is not available in areas under comprehensive sanctions or in certain locations due to local regulations.

I hope this will open the eyes of potential clients of ledger to this company and prevent them from purchasing their devices.

[The Sceptical Chymist]

Ledger is poison.

It is, yet so many people seem to love the taste of it and don't care about its toxicity in the least.

I'm going to have to go back and read about the details of this debacle, but is there anything preventing other HW wallet manufacturers from doing something similar?  I would imagine so; I even recall when the Electrum wallet for Dash was taken down from Github for what I think were political reasons, and I'm not even sure if those Dash could be restored if you didn't have the Electrum software.

Yep, my technical knowledge is still sketchy which is why all of this seems just a wee bit frightening to me.  You'd think in the world of crypto, you'd truly be in control of your coins as long as you had the seed phrase....but that's not 100% true, is it?

[Meuserna]

I'm going to have to go back and read about the details of this debacle, but is there anything preventing other HW wallet manufacturers from doing something similar?

If their code is closed source, they can do what Ledger did and worse.  Then again, we don't know if Ledger's code contains capabilities that are even worse.  That's the problem with closed source code.

Bitcoin is fully open source.  Your wallet should be too.

[satscraper]

This is just the jumpscare because, technically, such blocking is possible if users rely onL edger's own servers to send transactions, which means using Ledger Live app.

Everyone is forced to use ledger live at least one time, and even more because they need to update firmware^spyware? for their devices.

You mean they could block updates for Ledger devices or apps on them, right?

I don't see an issue with this threat either, as everyone is free to use VPN that masks their country's IP showing Ledger it's not on the sanctions list. So, those who are under sanctions shouldn't worry too much about these "jumpscares."

[ABCbits]

If i read title of this thread few years ago, i would think it's either april mop or satire content.

I'm going to have to go back and read about the details of this debacle, but is there anything preventing other HW wallet manufacturers from doing something similar?

If their code is closed source, they can do what Ledger did and worse.  Then again, we don't know if Ledger's code contains capabilities that are even worse.  That's the problem with closed source code.

Bitcoin is fully open source.  Your wallet should be too.

It seems this com sanctions compliance is part of Ledger Live. So it's worth to mention Ledger Live source code is available on GitHub. But don't ask me if it's reproducible or if it's whole/full source code. From quick search, it seems they begin to work on this feature since late May 2025, https://github.com/LedgerHQ/ledger-live/pull/10365.

I’m not located in a sanctioned area but I can’t purchase on Ledger.com, download or use Ledger Live. What does that mean?

As part of Ledger’s compliance measures, access to Ledger’s products and services is restricted based on IP address and is not available in areas under comprehensive sanctions or in certain locations due to local regulations. If you believe you have been wrongly located, please contact your internet service provider.

I bet this will make few Ledger users unable to use Ledger Live, without using VPN and connect to region that isn't sanctioned. And i'm not sure how contacting ISP would help fixing issue wrong detection by IP address.

[SFR10]

Maybe in the next 1 or two years, they will come up with another thing again. Or maybe they will come up with it within months.

Exactly and if I were to guess, I'd say they might impose various transaction limits ^{[e.g., daily, weekly and monthly]} based on users' verification levels on Ledger Live.

As part of Ledger’s compliance measures, access to Ledger’s products and services is restricted based on IP address and is not available in areas under comprehensive sanctions or in certain locations due to local regulations.

I hope this will open the eyes of potential clients of ledger to this company and prevent them from purchasing their devices.

Seeing what kind of users opt for their product nowadays makes me believe such things have little to no impact on their decisions ^{[unless they're directly affected (unfortunately)]}.

[Satofan44]

If it is required by law, blame the lawmaker not the wallet company.

I know Ledger will do something that will not disappointed about them again and this is another one. Maybe in the next 1 or two years, they will come up with another thing again. Or maybe they will come up with it within months.

While you should avoid using Ledger anyway, the blame is misdirected. I doubt anyone would spend money implementing these things unless they were required to do so.

Exactly and if I were to guess, I'd say they might impose various transaction limits ^{[e.g., daily, weekly and monthly]} based on users' verification levels on Ledger Live.

As long as you can use it with other software, such limits would not do anything. Why would you even use Ledger Live at all except for app updates?