Open source or closed: what wallet firmware tells you

Why it matters whether a wallet's code is open, how much of Ledger's is, what reproducible builds at BitBox prove, and what WalletScrutiny's tests can and cannot say.

Key points

Open code lets anyone check how a wallet makes and uses your keys, instead of having to trust the maker.
Ledger says 95% of its operating system and software is open. The low-level code for its secure chip is not, because the chip maker’s contract forbids it.
BitBox publishes its firmware and builds it reproducibly, so anyone can check that the file on the device matches the published code.

Why open code matters

The firmware decides how your keys are made, where they are kept, and what the device signs. If the code is closed, you have to trust the maker that it does nothing else. If it is open, researchers can read it and find mistakes or hidden functions.

Open code alone does not prove much, though. You also need to know that the device runs exactly the published code. That is what reproducible builds are for.

Ledger: 95% open

Ledger says its operating system and software are “95% OpenSource.” The rest is the low-level code that talks to the secure chip. Its agreement with the chip maker STMicroelectronics, Ledger says, legally prevents it from publishing that code. Ledger presents this as a trade-off it makes for the chip’s protection.

BitBox: open and reproducible

BitBox publishes its firmware on GitHub. Every release lists how to rebuild the file from the published code, signatures from people outside the company who did so, and the hash the device shows at startup. If your device shows the same hash, it runs the code everyone can read.

What WalletScrutiny says

WalletScrutiny is a project that tries to rebuild wallet software from its published code. Its page on the BitBox02, last updated on November 5, 2026, says the device “passed all 10 tests.”

WalletScrutiny itself warns against reading too much into this: a reproducible build means the published code matches the file, not that the code is free of flaws. It states that it does “not endorse the security of any wallet.”

Compared

	Ledger	BitBox
Firmware code public	apps on the device yes; the operating system partly	yes
Reproducible builds	not stated	yes, with a hash shown on the device
What you trust	Ledger and its chip maker for the closed part	the published code and the people who check it

What you can do

Decide what you want to trust: a closed secure chip, or open code that anyone can check.
Check the hash your BitBox shows at startup against the release notes, if you want to verify it yourself.
Update only through the maker’s own app, never with a file someone sends you.

Next step

The guide Secure element explained shows what the closed chip at Ledger and the secure chip at BitBox protect.

The figures in this guide come from the archive and change with every data update. As of November 13, 2026.

Open source or closed: what a hardware wallet's firmware tells you