New
Meet Cerberus: How the Ledger Donjon Built an AI Security…
Meet Cerberus: How the Ledger Donjon Built an AI Security Harness...
Security Research
Donjon @ Ledger
We are the security research team at Ledger, dedicated to protecting your digital assets through cutting-edge security research, vulnerability discovery, and open-source tools.
Security Bulletins
Technical details of past security issues, their impact, and available patches.
Threat Model
Comprehensive documentation of security objectives and mechanisms.
Tools Suite
Open-source security research tools for hardware and software analysis.
Bug Bounty
Report vulnerabilities and earn rewards for helping secure Ledger products.
Latest Blog Posts
View all posts New
Bypassing Tangem Card Security with a Laser Attack
After uncovering a genuine check bypass on the Tangem Android application and a brute-force attack on the card's authentication protocol, the Ledger Donjon turned its attention to the card itself with more advanced tools and sophisticated techniques. What we found is a critical vulnerability that lets an attacker with physical access to a single Tangem card reset its password and steal all associated funds.
New
A Second-Order Side-Channel Attack on Masked Kyber768
Part 3 of our series on side-channel attacks against post-quantum cryptography: masking defeats the first-order attack, but masked Kyber768 still falls to a second-order CPA.
Latest Security Bulletins
View all bulletins LSB 025
Ledger Security Bulletin 025
Swap flow accepted a token approval in place of a payment
LSB 024
Ledger Security Bulletin 024
Clear-signing bypass via array-count truncation in the Ethereum app
LSB 023
Ledger Security Bulletin 023
Command interleaving during an on-screen review could desynchronise the display from the signature
Found a vulnerability?
We reward security researchers who help us protect our users. Join our bug bounty program and get recognized in our Hall of Fame.