{"id":2919,"date":"2024-05-28T19:40:29","date_gmt":"2024-05-28T19:40:29","guid":{"rendered":"http:\/\/localhost\/dpetkovski\/?p=2919"},"modified":"2024-08-12T10:16:21","modified_gmt":"2024-08-12T10:16:21","slug":"is-ledger-a-hot-wallet-analysis-of-the-recovery-service","status":"publish","type":"post","link":"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/","title":{"rendered":"Is Ledger a Hot Wallet? Analysis of the Recovery Service"},"content":{"rendered":"<p>Ledger used to be the standard hardware wallet choice for most crypto investors.<\/p>\n<p>Some time ago, they announced Ledger Recover. It&#8217;s an optional service aimed at n00bs that don&#8217;t trust themselves to <a href=\"https:\/\/dpetkovski.com\/protect-your-seed-phrase-10-tips-to-secure-your-crypto\/\">take care of their seed phrase<\/a>.<\/p>\n<p>If you were a Ledger user with significant capital secured by it when this news came out, you were most probably shocked.<\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_60 ez-toc-wrap-center counter-hierarchy ez-toc-counter ez-toc-white ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title \" >Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\" role=\"button\"><label for=\"item-66e419e03d042\" ><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input aria-label=\"Toggle\" aria-label=\"item-66e419e03d042\"  type=\"checkbox\" id=\"item-66e419e03d042\"><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/#What_is_Ledger_Recover\" title=\"What is Ledger Recover?\">What is Ledger Recover?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/#The_Problem_With_Ledger_Recover\" title=\"The Problem With Ledger Recover\">The Problem With Ledger Recover<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/#Addressing_Common_Arguments\" title=\"Addressing Common Arguments\">Addressing Common Arguments<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/#%E2%80%9CAll_hardware_wallets_can_expose_your_seed%E2%80%9D\" title=\"&#8220;All hardware wallets can expose your seed&#8221;\">&#8220;All hardware wallets can expose your seed&#8221;<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/#%E2%80%9CI_Trust_Ledger%E2%80%9D\" title=\"&#8220;I Trust Ledger&#8221;\">&#8220;I Trust Ledger&#8221;<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/#%E2%80%9CJust_dont_upgrade_the_firmware_to_v221%E2%80%9D\" title=\"&#8220;Just don&#8217;t upgrade the firmware to v2.2.1&#8221;\">&#8220;Just don&#8217;t upgrade the firmware to v2.2.1&#8221;<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/#%E2%80%9CDont_put_everything_there_diversify_wallets%E2%80%9D\" title=\"&#8220;Don&#8217;t put everything there, diversify wallets&#8221;\">&#8220;Don&#8217;t put everything there, diversify wallets&#8221;<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/#%E2%80%9CI_trust_Ledger_more_than_me_not_making_a_mistake%E2%80%9D\" title=\"&#8220;I trust Ledger more than me not making a mistake&#8221;\">&#8220;I trust Ledger more than me not making a mistake&#8221;<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/#%E2%80%9CAnother_HW_also_offers_sharded_backups%E2%80%9D\" title=\"&#8220;[Another HW] also offers sharded backups&#8221;\">&#8220;[Another HW] also offers sharded backups&#8221;<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/#%E2%80%9CNothing_changed_for_me_it_was_always_like_this%E2%80%9D\" title=\"&#8220;Nothing changed for me \/ it was always like this&#8221;\">&#8220;Nothing changed for me \/ it was always like this&#8221;<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/#%E2%80%9CI_use_a_passphrase%E2%80%9D\" title=\"&#8220;I use a passphrase&#8221;\">&#8220;I use a passphrase&#8221;<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/#%E2%80%9CI_wont_opt-in_to_the_Recovery_Service%E2%80%9D\" title=\"&#8220;I won&#8217;t opt-in to the Recovery Service&#8221;\">&#8220;I won&#8217;t opt-in to the Recovery Service&#8221;<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/#Conclusion_TLDR\" title=\"Conclusion &amp; TLDR\">Conclusion &amp; TLDR<\/a><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"What_is_Ledger_Recover\"><\/span>What is Ledger Recover?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><a href=\"https:\/\/shop.ledger.com\/pages\/ledger-recover\">Ledger Recover<\/a> is an optional service for users of Ledger hardware wallets.<\/p>\n<p>If a user opts in, Ledger sends encrypted fragments of the device&#8217;s seed phrase to 3 companies as a backup. Upon user request and ID verification, the private key can be restored on a Ledger device.<\/p>\n<p>As you can imagine, this triggered outrage, uncertainty, and many discussions online.<\/p>\n<p>Eventually, someone asked for clarification on the Ledger subreddit and <a href=\"https:\/\/np.reddit.com\/r\/ledgerwallet\/comments\/13itm7u\/is_there_a_backdoor_yes_or_no\/jkbyyfp\/\">the cofounder responded<\/a>:<\/p>\n<blockquote><p>The device sends encrypted shards of your seed to different companies if you decide to use the service. You can of course still choose to backup it yourself.<\/p><\/blockquote>\n<p>Needless to say, subscribing to this service defies the purpose of <a href=\"https:\/\/dpetkovski.com\/self-custody-explained-not-your-keys-not-your-coins\">self-custody<\/a> (because you&#8217;re trusting third parties) and using a <a href=\"https:\/\/dpetkovski.com\/introduction-to-hardware-wallets-cold-storage-for-beginners\/\">hardware wallet<\/a> (because the seed exists online, although encrypted and sharded).<\/p>\n<p>But\u00a0<strong>using\u00a0<\/strong>the recovery service is not the problem. No sane user would use it anyway.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"The_Problem_With_Ledger_Recover\"><\/span>The Problem With Ledger Recover<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The problem is the <strong>technical ability\u00a0<\/strong>of the device to extract the seed phrase from the <a href=\"https:\/\/www.ledger.com\/academy\/glossary\/secure-element-se\">secure element<\/a>.<\/p>\n<p style=\"text-align: center;\"><strong>The ledger device, technically, can expose your seed phrase to the internet.<\/strong><\/p>\n<p>Ultimately, it&#8217;s a matter of the French government knocking on their doors and asking for it.<\/p>\n<p>But let&#8217;s assume Ledger is 100% trustworthy and would never inject a backdoor. Then, how can we know that the implementation of the recovery service is robust? What if there are bugs exposing the devices to third-party exploits?<\/p>\n<p>We can&#8217;t know &#8211; the firmware is closed source.<\/p>\n<p>In summary:<\/p>\n<p style=\"text-align: left;\"><strong>You can&#8217;t opt out from the device being able to leak data to the internet.<\/strong><\/p>\n<p style=\"text-align: left;\"><strong>You can only opt out of Ledger doing it intentionally.<\/strong><\/p>\n<h2><span class=\"ez-toc-section\" id=\"Addressing_Common_Arguments\"><\/span>Addressing Common Arguments<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Besides all facts, there are still people delivering pro-Ledger arguments that I&#8217;d like to address.<\/p>\n<p>Most of these are from people falling for <a href=\"https:\/\/en.wikipedia.org\/wiki\/Escalation_of_commitment\">commitment bias<\/a> because they&#8217;re customers. To me, this is <a href=\"https:\/\/en.wikipedia.org\/wiki\/Simp\">simping<\/a>. I also own 2 Ledger Nano S devices but I&#8217;m comfortable with the reality of the situation.<\/p>\n<p>Below I compiled a list of the most common misconceptions and will try to dispute them all:<\/p>\n<div class=\"contents\">\n<div class=\"min-w-0 \">\n<div class=\"relative\">\n<div id=\"t1_jlpac7d-comment-rtjson-content\" class=\"md text-14 rounded-[8px] pb-2xs pt-2xs\">\n<div class=\"contents\">\n<div class=\"min-w-0 \">\n<div class=\"relative\">\n<div id=\"t1_jlqgra7-comment-rtjson-content\" class=\"md text-14 rounded-[8px] pb-2xs pt-2xs\">\n<div id=\"-post-rtjson-content\" class=\"py-0 xs:mx-xs mx-2xs inline-block max-w-full\">\n<h3 class=\"text-24 xs:text-20\"><span class=\"ez-toc-section\" id=\"%E2%80%9CAll_hardware_wallets_can_expose_your_seed%E2%80%9D\"><\/span>&#8220;All hardware wallets can expose your seed&#8221;<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>This statement is technically true.<\/p>\n<p>However, it&#8217;s not an argument that defends Ledger&#8217;s position. Here&#8217;s why.<\/p>\n<p>While all hardware wallets <em>can<\/em> do it, most have <strong>open source firmware<\/strong>. This means that if such a change is implemented, you&#8217;ll know not to upgrade to that version and you won&#8217;t be at risk.<\/p>\n<p>Ledger has\u00a0<strong>closed source firmware<\/strong>\u00a0&#8211; this means that their code is not public and you\u00a0<strong>trust<\/strong>\u00a0them not to expose your seed.<\/p>\n<p><strong>TLDR All hardware wallets can leak your seed, but Ledger is one you can&#8217;t see coming.<\/strong><\/p>\n<h3><span class=\"ez-toc-section\" id=\"%E2%80%9CI_Trust_Ledger%E2%80%9D\"><\/span>&#8220;I Trust Ledger&#8221;<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>If you&#8217;re basing security on trust, just use a free CEX account. Why even bother with <a href=\"https:\/\/dpetkovski.com\/self-custody-explained-not-your-keys-not-your-coins\">self custody<\/a>?<\/p>\n<p>Also, why are you in crypto at all?<\/p>\n<p>Anyway, it&#8217;s easy to assume that Ledger doesn&#8217;t lie. I also believe they released the service as described. However:<\/p>\n<ul>\n<li>A chain of employees may organize a seed phrase heist<\/li>\n<li>An honest\/unintentional bug might expose your keys to the public<\/li>\n<li>A malicious actor can inject an exploit that interacts with the secure element<\/li>\n<\/ul>\n<p>Also, this is not the first time Ledger messes up:<\/p>\n<ul>\n<li>They had <a href=\"https:\/\/www.ledger.com\/message-ledgers-ceo-data-leak\">a data leak in 2020<\/a>, exposing the names and addresses of all their customers<\/li>\n<li>They put all Ledger users&#8217; assets at risk in 2023 through an <a href=\"https:\/\/www.ledger.com\/blog\/security-incident-report\">exploit in their Connect Kit<\/a><\/li>\n<\/ul>\n<p>How can you be 100% sure that an unintentional &#8220;seed leak&#8221; is not next?<\/p>\n<p><strong>TLDR While Ledger wouldn&#8217;t do it intentionally, never underestimate their negligence.<\/strong><\/p>\n<h3><span class=\"ez-toc-section\" id=\"%E2%80%9CJust_dont_upgrade_the_firmware_to_v221%E2%80%9D\"><\/span>&#8220;Just don&#8217;t upgrade the firmware to v2.2.1&#8221;<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Indeed, please don&#8217;t upgrade. Don&#8217;t even open Ledger Live if you can avoid it.<\/p>\n<p>However, as Ledger&#8217;s firmware is closed source, you can&#8217;t be sure that this functionality wasn&#8217;t there already. All we know is that the Ledger Recover service went live with v2.2.1 &#8211; which is a functionality on top of exposing seed phrases online.<\/p>\n<p>In the best case scenario, you&#8217;re safe if you don&#8217;t upgrade. But in the worst case scenario, Ledger and Emmanuel Macron already have your seed phrase.<\/p>\n<p><strong>TLDR You don&#8217;t know when the ability to extract the seed phrase was implemented.<\/strong><\/p>\n<h3 class=\"text-24 xs:text-20\"><span class=\"ez-toc-section\" id=\"%E2%80%9CDont_put_everything_there_diversify_wallets%E2%80%9D\"><\/span>&#8220;Don&#8217;t put everything there, diversify wallets&#8221;<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Arguments such as this one were common and plentiful.<\/p>\n<p>First of all, this is easy to say if your net-worth is $27. However, people with 6 or 7 figures in digital assets might disagree.<\/p>\n<p>Even Ledger confirmed in their <a href=\"https:\/\/twitter.com\/i\/spaces\/1RDxlavNoAzKL\">Twitter Space after the incident<\/a>\u00a0(1:03:30 until the end):<\/p>\n<blockquote><p>&#8220;We didn&#8217;t build this for maxis who have huge amounts of value on their Ledger.&#8221;<\/p><\/blockquote>\n<p>And the second point: even if you&#8217;re diversifying wallets, why wouldn&#8217;t you choose all of them to be as secure as possible?<\/p>\n<p><strong>TLDR Sticking with a potentially vulnerable wallet should not be an excuse for diversification.<\/strong><\/p>\n<h3 class=\"text-24 xs:text-20\"><span class=\"ez-toc-section\" id=\"%E2%80%9CI_trust_Ledger_more_than_me_not_making_a_mistake%E2%80%9D\"><\/span>&#8220;I trust Ledger more than me not making a mistake&#8221;<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Then you also trust other hardware wallet more than yourself, don&#8217;t you?<\/p>\n<p>Especially open source ones with which you&#8217;ll <strong>always<\/strong>\u00a0know\u00a0<strong>exactly<\/strong>\u00a0what&#8217;s going on.<\/p>\n<p>But most of these people are referring to them transferring the assets to the new wallet. Here&#8217;s a easy-to-follow tutorial:<\/p>\n<ol>\n<li>Buy a new wallet<\/li>\n<li>Click &#8220;Receive&#8221; and copy the address<\/li>\n<li>Go to your Ledger account<\/li>\n<li>Click &#8220;Send&#8221; and paste the address<\/li>\n<\/ol>\n<p><strong>TLDR You shouldn&#8217;t rely on trust.<\/strong><\/p>\n<h3><span class=\"ez-toc-section\" id=\"%E2%80%9CAnother_HW_also_offers_sharded_backups%E2%80%9D\"><\/span>&#8220;[Another HW] also offers sharded backups&#8221;<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Yes, there are other hardware wallets that offer <a href=\"https:\/\/trezor.io\/learn\/a\/what-is-shamir-backup\">sharded (Shamir) backups<\/a>.<\/p>\n<p>However, the seed phrase fragments aren&#8217;t sent anywhere. They&#8217;re generated and shown on the device itself. Then it&#8217;s up to the user, and not random companies, to write them down and store them securely.<\/p>\n<p>They&#8217;re never transferred from the cold wallet to a device connected to the internet.<\/p>\n<p>This is verifiably true.<\/p>\n<p><strong>TLDR The problem is not getting fancy with seed phrase backups, the problem is leaking secrets online.<\/strong><\/p>\n<h3 class=\"text-24 xs:text-20\"><span class=\"ez-toc-section\" id=\"%E2%80%9CNothing_changed_for_me_it_was_always_like_this%E2%80%9D\"><\/span>&#8220;Nothing changed for me \/ it was always like this&#8221;<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>This is true to an extent. Effectively, you were trusting Ledger with their proprietary software.<\/p>\n<p>But now we have confirmation that this vulnerability exists. Maybe you were aware of the possibility before, maybe you weren&#8217;t.<\/p>\n<p><strong>If you weren&#8217;t:<\/strong> you&#8217;re probably reevaluating your choice already.<\/p>\n<p><strong>If you were:<\/strong> you trusted that Ledger&#8217;s firmware won&#8217;t interact with the secure element in a malicious way. Ledger Recover is your reminder to revisit your decision.<\/p>\n<p>Of course, I understand that people might decide to stick with Ledger. And that&#8217;s fine if they understand the risks. I still keep mine, although I migrated my long-term positions to another hardware wallet.<\/p>\n<p><strong>TLDR There is new information &#8211; there&#8217;s a potentially exploitable vulnerability in the firmware.<\/strong><\/p>\n<h3 class=\"text-24 xs:text-20\"><span class=\"ez-toc-section\" id=\"%E2%80%9CI_use_a_passphrase%E2%80%9D\"><\/span>&#8220;I use a passphrase&#8221;<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Passphrases are a great way to generate new sets of addresses and increase security through plausible deniability.<\/p>\n<p>With that being said, you don&#8217;t know what Ledger does with the passphrases and whether the device stores them in memory.<\/p>\n<p>I know this because nobody has read Ledger&#8217;s firmware code.<\/p>\n<p><strong>TLDR Passphrases are part of the BIP-39 standard. You can continue using them with open source wallets.<\/strong><\/p>\n<h3 class=\"text-24 xs:text-20\"><span class=\"ez-toc-section\" id=\"%E2%80%9CI_wont_opt-in_to_the_Recovery_Service%E2%80%9D\"><\/span>&#8220;I won&#8217;t opt-in to the Recovery Service&#8221;<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The recovery service is irrelevant.<\/p>\n<p>The problem is the\u00a0<strong>device&#8217;s ability to access your seed and expose it to the internet<\/strong>.<\/p>\n<p>Ledger confirmed that this could always been done and now they&#8217;ll offer a service to do it for you (while sharding and encrypting it).<\/p>\n<p>With\u00a0open source hardware wallets, you can see their firmware code and know <strong>exactly<\/strong> what they&#8217;re doing with your seed. With Ledger, you have to trust their word.<\/p>\n<p><strong>TLDR You can opt out of the Recovery Service. You can&#8217;t opt out of the device&#8217;s ability to leak your seed.<\/strong><\/p>\n<h2 class=\"text-24 xs:text-20\"><span class=\"ez-toc-section\" id=\"Conclusion_TLDR\"><\/span>Conclusion &amp; TLDR<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Remember, the\u00a0<strong>only\u00a0<\/strong>advantage cold wallets have over hot wallets is the that the seed phrase will never be exposed to a device connected to the internet. I cover this in detail in my <a href=\"https:\/\/dpetkovski.com\/introduction-to-hardware-wallets-cold-storage-for-beginners\/\">introduction to hardware wallets<\/a>.<\/p>\n<p>Ledger hardware wallets fail this test because users of the recovery service can trigger exposing data from the secure element.<\/p>\n<p>This is a fact, <a href=\"https:\/\/www.ledger.com\/academy\/what-is-ledger-recover\">confirmed and offered by Ledger<\/a>.<\/p>\n<p>As your portfolio grows, you might want to reevaluate if you&#8217;re comfortable with this setup.<\/p>\n<p>While <a href=\"https:\/\/dpetkovski.com\/self-custody-explained-not-your-keys-not-your-coins\">being your own bank<\/a>, it&#8217;s all about what makes you sleep well at night.<\/p>\n<p>&nbsp;<\/p>\n<hr \/>\n<p><em>This post is not against Ledger nor promotion of any particular hardware wallet. This is my honest opinion about the <a href=\"https:\/\/shop.ledger.com\/pages\/ledger-recover\">Ledger Recover<\/a> service based on public information from the company. I still keep my Ledger devices but only use them for my <a href=\"https:\/\/dpetkovski.com\/airdrops-the-real-0-to-100k-opportunity\/\">DeFi adventures<\/a>. I moved my long-term positions to <a href=\"https:\/\/dpetkovski.com\/hardware-wallets-comparison-trezor-bitbox02-ledger-coldcard\/\">BitBox02<\/a> and <a href=\"https:\/\/dpetkovski.com\/review-of-the-keystone-3-pro-hardware-wallet\/\">Keystone 3 Pro<\/a>.<\/em><\/p>\n<p><em>Need a step-by-step guide to buying Bitcoin and securing it safely with a hardware wallet? Head to:\u00a0<strong><a href=\"https:\/\/dpetkovski.com\/self-custody-manual-bitcoin-hardware-wallets\/\">The Self Custody Manual<\/a><\/strong>.<\/em><\/p>\n<p>&nbsp;<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Ledger used to be the standard hardware wallet choice for most crypto investors. Some time ago, they announced Ledger Recover. It&rsquo;s an optional service aimed at n00bs that don&rsquo;t trust themselves to take care of their seed phrase. If you were a Ledger user with significant capital secured by it when this news came out,&nbsp;&hellip;<\/p>\n","protected":false},"author":1,"featured_media":2927,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,23],"tags":[],"ppma_author":[4],"class_list":["post-2919","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cryptocurrency","category-self-custody-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v21.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Is Ledger a Hot Wallet? Analysis of the Recovery Service - D. Petkovski<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Is Ledger a Hot Wallet? Analysis of the Recovery Service - D. Petkovski","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/#article","isPartOf":{"@id":"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/"},"author":{"name":"D. Petkovski","@id":"http:\/\/localhost\/dpetkovski\/#\/schema\/person\/ce4d9bf1ba43635723c9d1b513b58049"},"headline":"Is Ledger a Hot Wallet? Analysis of the Recovery Service","datePublished":"2024-05-28T19:40:29+00:00","dateModified":"2024-08-12T10:16:21+00:00","mainEntityOfPage":{"@id":"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/"},"wordCount":1566,"publisher":{"@id":"http:\/\/localhost\/dpetkovski\/#\/schema\/person\/ce4d9bf1ba43635723c9d1b513b58049"},"articleSection":["Cryptocurrency","Self-Custody &amp; Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/","url":"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/","name":"Is Ledger a Hot Wallet? Analysis of the Recovery Service - D. Petkovski","isPartOf":{"@id":"http:\/\/localhost\/dpetkovski\/#website"},"datePublished":"2024-05-28T19:40:29+00:00","dateModified":"2024-08-12T10:16:21+00:00","breadcrumb":{"@id":"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/"]}]},{"@type":"BreadcrumbList","@id":"http:\/\/localhost\/dpetkovski\/is-ledger-a-hot-wallet-analysis-of-the-recovery-service\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http:\/\/localhost\/dpetkovski\/"},{"@type":"ListItem","position":2,"name":"Is Ledger a Hot Wallet? Analysis of the Recovery Service"}]},{"@type":"WebSite","@id":"http:\/\/localhost\/dpetkovski\/#website","url":"http:\/\/localhost\/dpetkovski\/","name":"D. Petkovski","description":"","publisher":{"@id":"http:\/\/localhost\/dpetkovski\/#\/schema\/person\/ce4d9bf1ba43635723c9d1b513b58049"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http:\/\/localhost\/dpetkovski\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"http:\/\/localhost\/dpetkovski\/#\/schema\/person\/ce4d9bf1ba43635723c9d1b513b58049","name":"D. Petkovski","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"http:\/\/localhost\/dpetkovski\/#\/schema\/person\/image\/89ff1464b73463c0cc3966b32b10dd7a","url":"http:\/\/1.gravatar.com\/avatar\/?s=96&d=mm&r=g","contentUrl":"http:\/\/1.gravatar.com\/avatar\/?s=96&d=mm&r=g","caption":"D. Petkovski"},"logo":{"@id":"http:\/\/localhost\/dpetkovski\/#\/schema\/person\/image\/89ff1464b73463c0cc3966b32b10dd7a"},"description":"D. Petkovski \ud83d\udcd3 The Author\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Husband &amp; Father Software Engineer\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0StrengthCentric Bitcoin Hodler\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0DeFi Veteran \u00a0 \ud83c\udf0d Everything Enthusiast \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\ud83d\udd25 Optimist Revolutionizing ideas. Simplifying complexity. Sharing knowledge.","sameAs":["https:\/\/facebook.com\/dpetkovski","https:\/\/www.instagram.com\/strengthcentric\/","https:\/\/twitter.com\/petkovskix"],"url":"http:\/\/localhost\/dpetkovski\/author\/petkovski\/"}]}},"authors":[{"term_id":4,"user_id":1,"is_guest":0,"slug":"petkovski","display_name":"D. Petkovski","avatar_url":"http:\/\/2.gravatar.com\/avatar\/?s=96&d=mm&r=g","user_url":"","last_name":"","first_name":"","description":"<span style=\"font-size: 23px\">D. Petkovski<\/span> <br> <br>\r\n\r\n\ud83d\udcd3 The Author\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0  \u00a0 \u00a0 \u00a0 \u00a0<span class=\"css-1qaijid r-bcqeeo r-qvutc0 r-poiln3\"><img class=\"emoji\" role=\"img\" src=\"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/svg\/1f46a.svg\" alt=\"\ud83d\udc6a\" \/> Husband &amp; Father <\/span>\r\n<br>\r\n<span class=\"css-1qaijid r-bcqeeo r-qvutc0 r-poiln3\"><img class=\"emoji\" role=\"img\" src=\"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/svg\/1f5a5.svg\" alt=\"\ud83d\udda5\ufe0f\" \/> Software Engineer\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span><span class=\"css-1qaijid r-bcqeeo r-qvutc0 r-poiln3\"><img class=\"emoji\" role=\"img\" src=\"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/svg\/1f4aa.svg\" alt=\"\ud83d\udcaa\" \/><\/span><span class=\"css-1qaijid r-bcqeeo r-qvutc0 r-poiln3\">\u00a0StrengthCentric <\/span>\r\n<br>\r\n<span class=\"r-18u37iz\"><img class=\"r-4qtqp9 r-dflpy8 r-zw8f10 r-10akycc r-h9hxbl r-9cviqr\" src=\"https:\/\/abs.twimg.com\/hashflags\/Bitcoin_evergreen\/Bitcoin_evergreen.png\" alt=\"\" width=\"20\" height=\"20\" \/> <\/span> Bitcoin <span class=\"css-1qaijid r-bcqeeo r-qvutc0 r-poiln3\">Hodler\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0   \u00a0                            \u00a0 \u00a0 \u00a0<\/span><span class=\"css-1qaijid r-bcqeeo r-qvutc0 r-poiln3\"><img class=\"emoji\" role=\"img\" src=\"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/svg\/1f4c8.svg\" alt=\"\ud83d\udcc8\" \/><\/span>\u00a0<span class=\"r-18u37iz\">DeFi<\/span><span class=\"css-1qaijid r-bcqeeo r-qvutc0 r-poiln3\"> Veteran <\/span><span class=\"css-1qaijid r-bcqeeo r-qvutc0 r-poiln3\">\u00a0<\/span>\r\n<br>\r\n\ud83c\udf0d Everything Enthusiast              \u00a0 \u00a0 \u00a0 \u00a0   \u00a0 \u00a0 \u00a0              \u00a0   \u00a0\ud83d\udd25 Optimist <br><br>\r\n\r\nRevolutionizing ideas. Simplifying complexity. Sharing knowledge. \r\n"}],"_links":{"self":[{"href":"http:\/\/localhost\/dpetkovski\/wp-json\/wp\/v2\/posts\/2919"}],"collection":[{"href":"http:\/\/localhost\/dpetkovski\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/localhost\/dpetkovski\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/localhost\/dpetkovski\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/localhost\/dpetkovski\/wp-json\/wp\/v2\/comments?post=2919"}],"version-history":[{"count":34,"href":"http:\/\/localhost\/dpetkovski\/wp-json\/wp\/v2\/posts\/2919\/revisions"}],"predecessor-version":[{"id":4141,"href":"http:\/\/localhost\/dpetkovski\/wp-json\/wp\/v2\/posts\/2919\/revisions\/4141"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/localhost\/dpetkovski\/wp-json\/wp\/v2\/media\/2927"}],"wp:attachment":[{"href":"http:\/\/localhost\/dpetkovski\/wp-json\/wp\/v2\/media?parent=2919"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/localhost\/dpetkovski\/wp-json\/wp\/v2\/categories?post=2919"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/localhost\/dpetkovski\/wp-json\/wp\/v2\/tags?post=2919"},{"taxonomy":"author","embeddable":true,"href":"http:\/\/localhost\/dpetkovski\/wp-json\/wp\/v2\/ppma_author?post=2919"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}