Ledger Nano X: what it protects, what has leaked and what the Spanish tax authority never tells you

Analysis reviewed on September 7, 2026. The price is checked separately and carries its own date.

The Nano X is the best-selling hardware wallet in Europe and the one most people have sitting in a drawer. This page is not going to tell you whether it "feels nice to use": we have not used it. It is going to tell you what is inside it, what has happened to this company, and what it means in Spain to keep your coins there.

What it keeps, and where it keeps it

Inside the device there is an ST33J2M0 chip certified to CC EAL5+: the same family of components that goes into bank cards and electronic passports. Your private key lives in there and never leaves. When you move funds, the transaction goes in unsigned and comes out signed; the computer never sees the key, even if it is infected.

The Nano X adds Bluetooth (BLE 5.2), which is what sets it apart from the Nano S Plus. It is there so you can use it from a phone without a cable. It is worth understanding what travels over that link: already-signed transactions and requests to sign, not the key. The key has no way out over Bluetooth because it has no way out at all, full stop.

What you can check and what you have to take on trust

This is the uncomfortable part, and the one most often left unsaid. Ledger's firmware is closed: you cannot read the code that runs inside the secure element, nor compile it yourself. The EAL5+ certification was issued by an external laboratory and that counts for a great deal, but it is an audit you cannot repeat. With Ledger, in the end, you are trusting Ledger.

For plenty of people that is perfectly fine — you also trust whoever made your bank card — and for others it is precisely what they do not want. If you are in the second group, the alternative is on the Trezor Safe 5 page, which runs open firmware.

Three notices in six years, and not one about the device

This is the part that hardly ever makes it into a round-up, and all of it was published by the company itself:

• June-July 2020. A third party got into Ledger's e-commerce and marketing database. They took around one million email addresses and, for some 9,500 customers, name, postal address, phone number and which product they had ordered as well. Ledger notified the French data protection authority. Official statement.
  What that really means: a list of home addresses belonging to people known to keep cryptocurrency at home. Years of impersonation campaigns by email and by post came out of it, some of them with fake parcels.
• 14 December 2023. A former employee fell for an impersonation attack and the attacker got into their NPM account, stepping past the second factor with the session token. They published a malicious version of the Ledger Connect Kit — the piece many decentralised applications use to connect to the wallet — which pushed people into signing transactions that emptied wallets. Ledger deployed the fix within 40 minutes of learning about it; the file was in place for about five hours and the window of active theft was under two. Letter from the chief executive.
• January 2026. Ledger published a notice about order data handled by Global-e, its e-commerce provider. Notice in its support centre.

The pattern reads itself: the device has never been compromised. What gets compromised, over and over, is the data of the people who buy it. If it worries you that someone might know where you live and that you keep crypto there, that weighs on the decision more than any technical specification.

Ledger Recover: why it caused such a row

In 2023 Ledger launched Recover, an optional paid subscription — $9.99 a month — in which the device itself splits up and encrypts your recovery phrase and sends the fragments to three separate custodians: Coincover, Ledger and Escrowtech. To get it back you have to pass two identity checks with an identity document and a selfie. The manufacturer's explanation.

The service is optional and you have to sign up for it. That was not what upset people: it was finding out that the firmware can take fragments of the seed out of the device if it is asked to. A lot of people had understood that to be physically impossible. It was not: it was a software decision, and the software is closed. If your reason for owning a hardware wallet is not having to depend on anybody's goodwill, this is exactly the fact you need before you buy, not after.

Who it is for and who it is not for

Yes if you want the largest ecosystem — it supports more coins and more applications than anything else — if you are going to work from your phone, and if the backing of an external certification counts as guarantee enough for you.

No if your aim is not having to trust the manufacturer, if it makes you uneasy that your postal address has been going around in a leak, or if you hold less than €1,000 in crypto: in that case the device is not the best use of those euros, and we explain why on the page above.

And in Spain, does this change anything with the Agencia Tributaria, the Spanish tax authority?

Two things, both in your favour. Moving your coins off an exchange and onto this device is not taxed: it is not a disposal, so there is no gain to declare. And that balance stops counting towards Form 721, which only looks at what is custodied by entities outside Spain. When you sell, the gain will still be worked out from your original purchase price: moving resets nothing, and the calculator does it for you.

Frequently asked questions