crackthe.net
Hardware wallets compared
Ledger and BitBox as their makers describe them: the company and its country, open source, the devices they work with, and their CVE entries since 2021.
A hardware wallet keeps the keys to your cryptocurrency on a separate device. You confirm every transfer on its screen, so malware on your computer cannot sign one on its own. Whoever knows the recovery phrase controls the funds: keep it offline and never type it into a website or an app. This archive adds each maker's own CVE entries since 2021.
BitBox
- Company
Shift Crypto AG, Switzerland- Money back
- 90 days
- Open source
- yes
- Apps
- Windows, macOS, Linux, iOS, Android
- Own CVE entries since 2021
- none found
- Open source: “BitBox publishes its firmware and BitBoxApp source code so researchers can inspect how they work.” Its firmware builds are reproducible.
- The BitBox02 Nova has an EAL6+ certified secure chip that, according to BitBox, “can never learn any cryptocurrency-related secrets.” The app for iPhone and iPad supports only the Nova.
- Returns: unused orders within 90 days of delivery. A BitBox02 whose vacuum seal has been opened counts as used and cannot be refunded.
Ledger
In its own words: “Phones weren’t built for security, Ledger Atom™ is.”
- Company
Ledger SAS, France- Money back
- 14 days
- Open source
- partly
- Apps
- Windows, macOS, Linux, iOS, Android
- Own CVE entries since 2021
- 3, the latest in May 2026
- Secure element: “EAL6+ Secure Element to protect your private keys.” Ledger lists CC EAL6+ for Stax, Flex, Nano Gen5 and Nano S Plus, and CC EAL5+ for Nano X.
- The apps on the device are open source on GitHub. Ledger OS, the system on the device, is “the Ledger proprietary customized operating system.”
- Customer data leak, as Ledger reports it: in June 2020 about 1 million email addresses were exposed, and the names, postal addresses, and phone numbers of 9,500 customers. In December 2020 the data of about 272,000 customers was published.
