Staying safe while you use Ledger Live Desktop

Rule one: the recovery phrase stays offline

Your 24-word recovery phrase is the wallet. Anybody who has those words can restore your wallet on their own device and spend everything in it, and they do not need your hardware wallet, your PIN or your computer to do it. Every serious scam aimed at Ledger owners is a variation on getting those words out of you.

That gives you one rule that covers almost everything:

• Paper or steel, never digital. No photos, no cloud notes, no password managers, no screenshots, no email drafts. A photo of the sheet on your phone is the same as no protection at all.
• Write it by hand and check it twice. Order matters, and one wrong word can be a different wallet you cannot restore.
• Keep it physically separate from the device. A fire or a theft should not take both.
• Never split it with anyone. Not a friend, not a family member, not a "wallet recovery" service — however good the story sounds.

Rule two: the device screen is the truth

The app runs on a computer that could be compromised. The hardware wallet does not. So the device screen is the one display in your setup that an attacker cannot rewrite, and it is where you check the things that matter: the receive address you are about to share, the destination and amount of a payment, and the details of anything you are asked to sign.

This is why the app nags you. Verifying the address on the device is not a formality; it is the mechanism that defeats malware designed to swap addresses in a computer's clipboard or in the app's own display.

Fake apps and look-alike downloads

The most direct attack on a desktop user is a fake build of Ledger Live. It looks right, it installs, it may even show a plausible app — and at some point it asks for your recovery phrase. Common delivery routes:

• Sponsored search results and adverts pointing at near-identical domains.
• Emails or texts announcing a "critical update" with a download link.
• Software-portal and "free download" sites that re-host a modified installer.
• Links posted in forums, chat groups and video descriptions.

Defences are simple and take seconds: reach the site by typing ledger.com or through a bookmark you created yourself; read the domain rather than the logo; never install a wallet app you received as a link; and treat an emailed "update" as phishing by default.

The scams aimed at wallet owners

If you use an advanced passphrase

An optional passphrase, sometimes called BIP39, adds a word or phrase of your own on top of the recovery phrase and creates a separate hidden wallet. It is a genuine security upgrade against someone who finds your written seed — and a genuine way to lose everything if you forget it, because there is no reset and no recovery. If you use one, store it separately from the recovery phrase and understand that it is not the same thing as your device PIN.

If you think you have been compromised

1. Move the funds. Using a trusted device, create or restore a wallet whose recovery phrase has never been typed anywhere, and send your assets to it. This is the only action that actually helps.
2. Do not enter the old phrase anywhere new. If the words may be known, treat that wallet as finished — a new wallet means new words.
3. Check for surprise transactions. An attacker with the phrase can empty accounts without touching your device, so look at the blockchain history rather than at whether the device is intact.
4. Report it. Tell official Ledger support, and report the fake site or message to the platform hosting it. Warn others in the same situation, but never post the words themselves.

Everyday checklist

• Ledger Live installed from ledger.com and from nowhere else.
• Recovery phrase on paper or steel, offline, in a second location, never photographed.
• Device PIN set, and never written next to the device.
• Receive addresses verified on the device screen every time.
• Send destinations read on the device screen before approving.
• Operating system and the app itself kept up to date.
• Unsolicited messages about your wallet treated as hostile.

Keep reading