- Top reward
- Not published
- Top severity paid
- Not published
- Assets in scope
- 17
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 1 day
- As the policy promises.
- Paid by Bitcoin
- No identity requirement stated.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
Bounties will be paid directly to the researcher using Bitcoin.
- Response
-
Within 1 days
The Ledger Security Team will be in touch, usually within 24 hours.
- Safe harbor
-
Partial
Ledger commits that security researchers reporting bugs will be protected from legal liability, so long as they follow responsible disclosure guidelines and principles.
- Hall of fame
-
Yes
In mutual consultation, we can, if you desire, display a researcher's name or its pseudonym as the discoverer of the reported vulnerability on our website's Hall of Fame .
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
17 assets you may test, 14 excluded.
Source code 13
- app-bitcoin
- app-bitcoin-new
- app-ethereum
- app-exchange
- app-hyperliquid
- app-monero
- app-openpgp
- app-recovery-check
- app-security-key
- app-solana
- app-sui
- app-tron
- app-xrp
Desktop and binaries 1
- Software attacks on the firmware running on the devices
Domains 1
- ledger.com
Hardware and IoT 1
- Hardware attacks on the Ledger devices (i.e. hardware products)
Products and areas 1
- Ledger Wallet (Desktop and Mobile)
Out of scope (14)
- Attacks requiring prior local access to the computer or mobile device (e.g. malware already installed, physical access to an unlocked machine)
- Broken links
- Denial of service against Ledger Wallet (app crashes without security impact)
- Editable Github wikis
- Outdated dependencies without a demonstrated exploitable vulnerability
- Outdated software without any noteworthy vulnerability
- Reports from automated scanners without manual verification (see AI-generated reports policy)
- Reports from automated tools or scans
- Reports of insecure SSL/TLS ciphers (unless you have a working proof of concept)
- Self-XSS or issues requiring unlikely user interaction chains
- Theoretical vulnerabilities without a working proof-of-concept demonstrating actual exploitation on the device
- UI/UX bugs with no security impact (cosmetic glitches, typos, layout issues)
- Vulnerabilities in third-party dApps themselves that do not impact Ledger Wallet or its users beyond the dApp's own scope
- Vulnerabilities requiring physical access to an already-unlocked Ledger device
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Ledger DonJon's policy. "We" in these lines means the program, not this site.
While testing
-
Do not engage in testing that degrades Ledger's information systems and products
-
Do not access, store, share or destroy Ledger or user data
-
Do not impact Ledger users, such as denial of service, social engineering or spam
-
Do not exploit vulnerabilities on our infrastructure — the Bounty Program is about improving security, not deliberately putting the community at risk
-
Please only submit one report per issue.
-
All communications between you and Ledger should go through our vulnerability report form.
-
Only contact the Ledger Security Team through the official submission channels mentioned above
-
Do not send repeated, unsolicited, or follow-up messages pressuring for a response or reward
Not accepted
-
Displaying wrong information in Ledger Wallet / Ledger Live when the device correctly displays the transaction details or shows a warning to the user
-
Presence/absence of SPF/DMARC records
-
Lack of CSRF tokens
-
Clickjacking and tabnagging issues
-
Missing security headers which do not lead directly to a vulnerability
-
Missing best practices (we require evidence of a security vulnerability)
-
Absence of rate limiting
-
Transaction display discrepancies in Ledger Wallet when the hardware device correctly shows the transaction details or warns the user
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.