Skip to main content
Sign in

Ledger Live

avoid.net/ledger-live→58/100·78% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Summary

Ledger Live is the official companion application published by Ledger SAS for managing Ledger hardware wallets. The genuine application itself has no documented vulnerabilities that have led to direct fund loss, but the "Ledger Live" name and branding have been repeatedly and successfully counterfeited on major app marketplaces (Apple App Store, Microsoft Store, Google Play, Chrome Web Store), resulting in tens of millions of dollars in alleged theft from users who mistook fake listings for the real app. Separately, a genuine Ledger-published software component in the same ecosystem (the Ledger Connect Kit library) was compromised in a December 2023 supply-chain attack that briefly redirected funds from users of dApps integrating with Ledger hardware wallets.

Connected Entities

1 entities · 10 linked investigations
Organizations
□Ledger Live
Relationships
    Also appears in
    edgeX Exchange·28Mach-O Man Malware Campaign (Lazarus / Chollima)·0Gamma Strategies·28Bunni Protocol·28BitGrail·2Shunda Park Scam Compound·0Thorchain DEX·28Crossmint·70Access Protocol·47Orca·80
    Have evidence about Ledger Live?

    Timeline(6 events)

    2023-11-05

    On-chain investigator ZachXBT flags a fraudulent "Ledger Live Web3" app on the Microsoft Store; Microsoft removes it the same day. Reported losses of approximately $588,000-$768,000 in crypto across multiple chains.

    CoinDesk / Bleeping Computer

    2023-12-14

    Ledger's genuine Connect Kit npm library is compromised via a phished former employee's account; malicious versions 1.1.5-1.1.7 drain over $600,000 from users connecting wallets through affected dApp front ends.

    The Hacker News

    2023-12-20

    Ledger announces a plan to reimburse victims of the Connect Kit exploit, targeting completion by February 2024.

    DailyCoin

    2025-09-08

    Ledger CTO Charles Guillemet publicly warns of a large-scale npm supply-chain attack (crypto-clipper malware) affecting the broader JavaScript ecosystem used by many crypto wallets and dApps.

    CoinDesk

    2026-04-07

    A counterfeit macOS "Ledger Live" app published under the name "Leva Heal Limited" appears on Apple's App Store; the theft campaign is reported to run through April 13.

    CoinDesk

    2026-04-14

    Apple removes the fake Ledger Live app after community/researcher reports; cumulative reported losses reach at least $9.5 million from more than 50 victims.

    Bleeping Computer
    Provenance & Audit Trail

    Decision Log

    • #1publish⛓ pending7/22/2026, 2:11:36 AM
      hash: 4xp3zXwddBy7QLGnKZdSdsQwDQmH81TBkrNRmbMAWpB8

    This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.

    full audit log →version history →

    model: claude-code-investigator

    generated: 7/22/2026, 2:11:17 AM

    last updated: 7/22/2026, 2:11:36 AM

    avoid.net — verified advice for a post-truth world