Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #5[disputed][awaiting moderator]in the summary

   “resulting in tens of millions of dollars in alleged theft from users who mistook fake listings for the real app”

   reviewerCounterfeit Ledger Live apps have resulted in tens of millions of dollars in alleged theft.The page's own cited incidents total approximately $10.3 million ($768,000 + $9.5 million), which is roughly $10 million, not 'tens of millions.' No additional dollar-denominated counterfeit-Ledger-Live incidents beyond these two were found in independent searching, so the aggregate figure in the summary overstates what the page's own evidence supports.
   Proposed correction (not yet applied)

   resulting in more than $10 million in alleged theft from users who mistook fake listings for the real app

No source the reviewer could reach confirms or contradicts the claim.

1. #30[unverifiable][awaiting moderator]in section: Ledger's mitigation posture

   “Following the December 2023 Connect Kit incident, Ledger committed to and reportedly carried out a victim-reimbursement program.”

   reviewerFollowing the December 2023 Connect Kit incident, Ledger's reimbursement program was reportedly carried out (i.e., completed, not merely announced).The cited source only documents the announcement of the reimbursement plan. No independent reporting was found confirming the program was actually completed as claimed by the word 'carried out.' The hedge 'reportedly' is present but the underlying report of completion could not be located.
   citeddailycoin.com/ledger-unveils-plan-to-rei…er-hack-victims/

The claim was accurate when written but events since have overtaken it.

1. #1[stale][awaiting moderator]in the summary

   “Ledger Live is the official companion application published by Ledger SAS for managing Ledger hardware wallets.”

   reviewerLedger Live is presented in the present tense as the current official companion application name published by Ledger SAS.Ledger announced in October 2025 and completed by mid-2026 a rebrand of Ledger Live to 'Ledger Wallet.' As of the review date (Sept 2026), describing Ledger Live as the current official app name in the present tense is stale; the historical incidents described on the page are unaffected since they occurred under the old name.
   Proposed correction (not yet applied)

   Ledger Live — rebranded to Ledger Wallet in October 2025 — was the official companion application published by Ledger SAS for managing Ledger hardware wallets.
2. #2[stale][awaiting moderator]in section: Scope note: relationship to the "Ledger" hardware company page

   “This page is scoped specifically to Ledger Live, the companion desktop/mobile software application, and documents incidents that are distinct to the app-distribution layer”

   reviewerThe page's scope note describes 'Ledger Live' as the current name of the companion software application.Same underlying staleness as the summary's identity claim — the product has since been renamed.
   Proposed correction (not yet applied)

   This page is scoped specifically to Ledger Live (rebranded Ledger Wallet in October 2025), the companion desktop/mobile software application, and documents incidents that are distinct to the app-distribution layer

The cited evidence supports part of the claim but not all of it.

1. #21[partially supported][awaiting moderator]in section: December 2023 Ledger Connect Kit supply-chain attack

   “Reported losses from the roughly two-hour exploitation window (the malicious code was live for about five hours in total) exceeded $600,000”

   reviewerReported losses from the roughly two-hour exploitation window (malicious code live for about five hours total) exceeded $600,000.The page's cited source (Hacker News) does support the $600,000+ figure, but a second tier-1 source cited elsewhere on the same page (CoinDesk) reports a notably lower $484,000 figure for the same event. The page presents only the higher estimate without noting the range, which is a selective (though sourced) characterization.
   citedthehackernews.com/2023/12/crypto-hardwar…gers-supply.html
2. #37[partially supported][awaiting moderator]in the timeline

   “Apple removes the fake Ledger Live app after community/researcher reports; cumulative reported losses reach at least $9.5 million from more than 50 victims.”

   reviewerOn 2026-04-14, Apple removes the fake Ledger Live app after community/researcher reports; cumulative losses reach at least $9.5 million from more than 50 victims.The $9.5M/50-victim figures and the community-driven-removal characterization are solidly confirmed. The exact removal date is reported inconsistently across otherwise reputable sources (April 13 in 9to5mac vs. implicitly April 14 in the two April-14-dated CoinDesk/BleepingComputer articles), so the specific date field carries residual uncertainty not present in the rest of the entry.
   citedwww.bleepingcomputer.com/news/security/f…e-95m-in-crypto/

The cited evidence supports the claim as written.

1. #3[confirmed][no action needed]in the summary

   “The genuine application itself has no documented vulnerabilities that have led to direct fund loss”

   reviewerThe genuine Ledger Live application itself has no documented vulnerabilities that have led to direct fund loss.Literally true as worded — no vulnerability in Ledger Live/Wallet itself, nor in the related Ethereum app, is documented to have caused fund loss — but the page's coverage gap (see coverage_gaps) is that a genuine software vulnerability in the broader Ledger app ecosystem was disclosed in August 2026 and is not mentioned.
2. #4[confirmed][no action needed]in the summary

   “the "Ledger Live" name and branding have been repeatedly and successfully counterfeited on major app marketplaces (Apple App Store, Microsoft Store, Google Play, Chrome Web Store)”

   reviewerThe Ledger Live name and branding have been counterfeited on the Apple App Store, Microsoft Store, Google Play, and Chrome Web Store.Documented incidents exist for Microsoft Store and Apple App Store with dollar losses; Google Play and Chrome Web Store are corroborated by Ledger's own official warnings, though without a specific attributed loss figure.
   citedwww.coindesk.com/business/2026/04/14/a-f…illion-in-cryptowww.bleepingcomputer.com/news/security/f…8-000-in-crypto/
3. #6[confirmed][no action needed]in the summary

   “a genuine Ledger-published software component in the same ecosystem (the Ledger Connect Kit library) was compromised in a December 2023 supply-chain attack that briefly redirected funds from users of dApps integrating with Ledger hardware wallets”

   reviewerA genuine Ledger-published software component, the Ledger Connect Kit library, was compromised in a December 2023 supply-chain attack.Well documented across multiple tier-1 sources.
   citedthehackernews.com/2023/12/crypto-hardwar…gers-supply.html
4. #7[confirmed][no action needed]in section: Recurring counterfeit "Ledger Live" apps on major app stores

   “In November 2023, a fake app titled "Ledger Live Web3" was listed on the Microsoft Store”

   reviewerIn November 2023 a fake app titled "Ledger Live Web3" was listed on the Microsoft Store.Confirmed by BleepingComputer and corroborated across multiple outlets.
   citedwww.coindesk.com/business/2023/11/06/mic…tolen-by-hackerswww.bleepingcomputer.com/news/security/f…8-000-in-crypto/
5. #8[confirmed][no action needed]in section: Recurring counterfeit "Ledger Live" apps on major app stores

   “on-chain investigator ZachXBT identified roughly $588,000 in Bitcoin theft tied to the app”

   reviewerOn-chain investigator ZachXBT identified roughly $588,000 in Bitcoin theft tied to the fake app.Figure matches source almost exactly ($587,238 vs. page's 'roughly $588,000').
   citeddecrypt.co/204506/fake-ledger-app-micros…pp-store-zachxbt
6. #9[confirmed][no action needed]in section: Recurring counterfeit "Ledger Live" apps on major app stores

   “with total losses across Bitcoin, Ethereum, and BNB Smart Chain reportedly reaching approximately $768,000”

   reviewerTotal losses across Bitcoin, Ethereum, and BNB Smart Chain reportedly reached approximately $768,000.Matches cited reporting closely.
   citedwww.bleepingcomputer.com/news/security/f…8-000-in-crypto/
7. #10[confirmed][no action needed]in section: Recurring counterfeit "Ledger Live" apps on major app stores

   “before Microsoft removed the listing the same day it was flagged, on November 5, 2023”

   reviewerMicrosoft removed the fake app listing the same day it was flagged, on November 5, 2023.Confirmed.
   citedwww.bleepingcomputer.com/news/security/f…8-000-in-crypto/
8. #11[confirmed][no action needed]in section: Recurring counterfeit "Ledger Live" apps on major app stores

   “a counterfeit macOS "Ledger Live" application published under the shell-entity name "Leva Heal Limited" — which multiple outlets reported had no connection to Ledger SAS”

   reviewerIn April 2026 a counterfeit macOS "Ledger Live" app was published under the shell-entity name "Leva Heal Limited," which multiple outlets reported had no connection to Ledger SAS.Confirmed.
   citedwww.bleepingcomputer.com/news/security/f…e-95m-in-crypto/
9. #12[confirmed][no action needed]in section: Recurring counterfeit "Ledger Live" apps on major app stores

   “remained live on Apple's App Store from approximately April 7 to April 14, 2026”

   reviewerThe counterfeit macOS app remained live on Apple's App Store from approximately April 7 to April 14, 2026.The 'approximately' hedge accommodates the minor day-level discrepancy across sources (April 13 vs 14 for the removal date).
   citedwww.coindesk.com/business/2026/04/14/a-f…illion-in-crypto
10. #13[confirmed][no action needed]in section: Recurring counterfeit "Ledger Live" apps on major app stores

    “Reporting indicates the app was pulled only after community and researcher reports rather than by Apple's automated review”

    reviewerReporting indicates the app was pulled only after community and researcher reports rather than by Apple's automated review.Confirmed across independent sources; no source credits Apple's automated review with catching it.
    citedphishfort.com/fake-crypto-apps-app-store-phishing-scam/
11. #14[confirmed][no action needed]in section: Recurring counterfeit "Ledger Live" apps on major app stores

    “it was linked to at least $9.5 million stolen from more than 50 victims across Bitcoin, Ethereum, Solana, Tron, and XRP”

    reviewerThe app was linked to at least $9.5 million stolen from more than 50 victims across Bitcoin, Ethereum, Solana, Tron, and XRP.Confirmed.
    citedwww.bleepingcomputer.com/news/security/f…e-95m-in-crypto/
12. #15[confirmed][no action needed]in section: Recurring counterfeit "Ledger Live" apps on major app stores

    “the three largest individual losses reported at roughly $3.23 million in USDT, $2.08 million in USDC, and $1.95 million combined in BTC, ETH, and stETH”

    reviewerThe three largest individual losses were roughly $3.23 million in USDT, $2.08 million in USDC, and $1.95 million combined in BTC, ETH, and stETH.Figures match the underlying CoinDesk reporting exactly.
    citedwww.coindesk.com/business/2026/04/14/a-f…illion-in-crypto
13. #16[confirmed][no action needed]in section: Recurring counterfeit "Ledger Live" apps on major app stores

    “Stolen funds were reportedly routed through more than 150 deposit addresses at the exchange KuCoin and an alleged laundering service referred to as "AudiA6."”

    reviewerStolen funds were reportedly routed through more than 150 deposit addresses at KuCoin and an alleged laundering service referred to as "AudiA6."Confirmed, including the KuCoin freeze response reported separately.
    citedwww.coindesk.com/business/2026/04/14/a-f…illion-in-crypto
14. #17[confirmed][no action needed]in section: Recurring counterfeit "Ledger Live" apps on major app stores

    “Ledger's own support documentation separately warns that fraudulent "Ledger Live" apps have also appeared on Google Play and the Chrome Web Store”

    reviewerLedger's own support documentation warns that fraudulent Ledger Live apps have also appeared on Google Play and the Chrome Web Store.Confirmed via Ledger's own official channel.
    citedsupport.ledger.com/article/fraudulent-le…ive-applicationsx.com/ledger_support/status/129026886347…21440?lang=en-GB
15. #18[confirmed][no action needed]in section: Recurring counterfeit "Ledger Live" apps on major app stores

    “the company's official support account has publicly warned users never to enter a recovery phrase into any app”

    reviewerThe company's official support account has publicly warned users never to enter a recovery phrase into any app.Confirmed.
    citedx.com/ledger_support/status/129026886347…21440?lang=en-GB
16. #19[confirmed][no action needed]in section: December 2023 Ledger Connect Kit supply-chain attack

    “On December 14, 2023, Ledger disclosed that a genuine, Ledger-published npm software package — @ledgerhq/connect-kit, a library used by decentralized applications (dApps) such as SushiSwap and Revoke.Cash to let users connect Ledger hardware wallets to web front ends — was compromised in a supply-chain attack”

    reviewerOn December 14, 2023, Ledger disclosed the @ledgerhq/connect-kit compromise, a library used by dApps such as SushiSwap and Revoke.Cash.Confirmed across multiple sources.
    citedthehackernews.com/2023/12/crypto-hardwar…gers-supply.htmlwww.coindesk.com/business/2023/12/14/led…o-malicious-code
17. #20[confirmed][no action needed]in section: December 2023 Ledger Connect Kit supply-chain attack

    “a former Ledger employee fell victim to a phishing attack that gave attackers access to Ledger's npm publishing account, allowing them to upload three malicious versions of the package (1.1.5, 1.1.6, and 1.1.7)”

    reviewerA former Ledger employee fell victim to a phishing attack that gave attackers access to Ledger's npm publishing account, allowing upload of malicious versions 1.1.5, 1.1.6, and 1.1.7, which drained wallets via a rogue WalletConnect project.Confirmed in detail.
    citedthehackernews.com/2023/12/crypto-hardwar…gers-supply.html
18. #22[confirmed][no action needed]in section: December 2023 Ledger Connect Kit supply-chain attack

    “Ledger stated it removed the malicious versions, published a fixed version (1.1.8), reported attacker wallet addresses to authorities, and coordinated with stablecoin issuer Tether to freeze some stolen funds”

    reviewerLedger removed the malicious versions, published a fixed version (1.1.8), reported attacker wallet addresses to authorities, and coordinated with Tether to freeze some stolen funds.Confirmed.
    citedthehackernews.com/2023/12/crypto-hardwar…gers-supply.html
19. #23[confirmed][no action needed]in section: December 2023 Ledger Connect Kit supply-chain attack

    “on December 20, 2023, Ledger announced a plan to reimburse affected users, targeting completion by February 2024”

    reviewerOn December 20, 2023, Ledger announced a plan to reimburse affected users, targeting completion by February 2024.Confirmed exactly.
    citeddailycoin.com/ledger-unveils-plan-to-rei…er-hack-victims/
20. #24[confirmed][no action needed]in section: December 2023 Ledger Connect Kit supply-chain attack

    “Attribution of the underlying attackers has not been definitively confirmed in public reporting, though some coverage has referenced links to the phishing group "Angel Drainer."”

    reviewerAttribution of the underlying attackers has not been definitively confirmed, though some coverage has referenced links to the phishing group "Angel Drainer."The hedged, non-definitive phrasing matches the actual state of public attribution.
21. #25[confirmed][no action needed]in section: September 2025 NPM ecosystem warning

    “following the compromise of a widely-used npm publishing account (belonging to developer "Qix"), malicious code described as "crypto-clipper" malware was injected into JavaScript packages with a reported combined download count exceeding one billion”

    reviewerThe September 2025 npm compromise involved a widely-used account belonging to developer "Qix," with crypto-clipper malware injected into packages with over one billion combined downloads.Confirmed; the specific 1B+ figure matches the page's cited CoinDesk headline, and is a conservative subset of higher totals reported elsewhere.
    citedwww.coindesk.com/tech/2025/09/08/ledger-…ing-1b-downloads
22. #26[confirmed][no action needed]in section: September 2025 NPM ecosystem warning

    “Charles Guillemet, publicly warned crypto users about the incident and specifically advised hardware-wallet users, including those relying on Ledger Live, to carefully verify every transaction detail on their device screen before signing, and advised software-wallet users to avoid on-chain transactions until the incident was resolved”

    reviewerLedger's CTO Charles Guillemet publicly warned users, advising hardware-wallet users to verify every transaction detail on-device and advising software-wallet users to avoid on-chain transactions until resolved.Confirmed with precise wording match.
    citedwww.coindesk.com/tech/2025/09/08/ledger-…ing-1b-downloads
23. #27[confirmed][no action needed]in section: September 2025 NPM ecosystem warning

    “Later reporting from The Block indicated the attack was contained with reportedly minimal financial impact”

    reviewerLater reporting from The Block indicated the September 2025 npm attack was contained with reportedly minimal financial impact.Confirmed, and actually understates how minimal the impact was (~$503, not just 'minimal').
    citedwww.theblock.co/post/369984/npm-supply-c…-ledger-cto-says
24. #28[confirmed][no action needed]in section: Ledger's mitigation posture

    “The company states unambiguously that it distributes Ledger Live for desktop platforms only through its own website and has never published a macOS listing on the Apple App Store”

    reviewerLedger states it distributes desktop Ledger Live only through its own website and has never published a macOS listing on the Apple App Store.The claim is specific to macOS listings and holds up; it should not be conflated with Ledger's legitimate iOS App Store app for iPhone, which does exist.
    citedsupport.ledger.com/article/fraudulent-le…ive-applications
25. #29[confirmed][no action needed]in section: Ledger's mitigation posture

    “its official support social media account has issued public warnings about fake Ledger Live listings on app stores dating back to at least 2020”

    reviewerLedger's official support social media account has issued public warnings about fake Ledger Live listings dating back to at least 2020.Confirmed.
    citedx.com/ledger_support/status/129026886347…21440?lang=en-GB
26. #31[confirmed][no action needed]in section: Ledger's mitigation posture

    “the recurrence of successful counterfeit-app incidents in 2023 and again in 2026 suggests the underlying risk — rooted in third-party app store review processes rather than in Ledger's own software — has not been resolved”

    reviewerThe recurrence of successful counterfeit-app incidents in 2023 and again in 2026 suggests the underlying risk has not been resolved.This is an analytical/interpretive claim rather than a discrete factual assertion, but it is reasonably supported by the two documented incidents on the page.
27. #32[confirmed][no action needed]in the timeline

    “On-chain investigator ZachXBT flags a fraudulent "Ledger Live Web3" app on the Microsoft Store; Microsoft removes it the same day. Reported losses of approximately $588,000-$768,000 in crypto across multiple chains.”

    reviewerOn 2023-11-05, ZachXBT flags the fraudulent "Ledger Live Web3" app and Microsoft removes it the same day; losses of approximately $588,000-$768,000.Date field and event description confirmed.
    citedwww.coindesk.com/business/2023/11/06/mic…tolen-by-hackers
28. #33[confirmed][no action needed]in the timeline

    “Ledger's genuine Connect Kit npm library is compromised via a phished former employee's account; malicious versions 1.1.5-1.1.7 drain over $600,000 from users connecting wallets through affected dApp front ends.”

    reviewerOn 2023-12-14, Ledger's Connect Kit npm library is compromised via a phished former employee's account; malicious versions drain over $600,000.Date field confirmed as Dec 14, 2023.
    citedthehackernews.com/2023/12/crypto-hardwar…gers-supply.html
29. #34[confirmed][no action needed]in the timeline

    “Ledger announces a plan to reimburse victims of the Connect Kit exploit, targeting completion by February 2024.”

    reviewerOn 2023-12-20, Ledger announces a plan to reimburse victims, targeting completion by February 2024.Date field confirmed.
    citeddailycoin.com/ledger-unveils-plan-to-rei…er-hack-victims/
30. #35[confirmed][no action needed]in the timeline

    “Ledger CTO Charles Guillemet publicly warns of a large-scale npm supply-chain attack (crypto-clipper malware) affecting the broader JavaScript ecosystem used by many crypto wallets and dApps.”

    reviewerOn 2025-09-08, Ledger CTO Charles Guillemet publicly warns of a large-scale npm supply-chain attack affecting the broader JavaScript ecosystem.Date field confirmed.
    citedwww.coindesk.com/tech/2025/09/08/ledger-…ing-1b-downloads
31. #36[confirmed][no action needed]in the timeline

    “A counterfeit macOS "Ledger Live" app published under the name "Leva Heal Limited" appears on Apple's App Store; the theft campaign is reported to run through April 13.”

    reviewerOn 2026-04-07, a counterfeit macOS "Ledger Live" app under "Leva Heal Limited" appears on the App Store; the theft campaign runs through April 13.Date range for the theft window is well supported.
    citedwww.coindesk.com/business/2026/04/14/a-f…illion-in-crypto