The Short Version
Ledger Recover is an optional, paid backup service for your Ledger’s recovery phrase, which Ledger calls a “spare key”. Your device encrypts that key inside its secure element, splits it into three encrypted pieces and sends them to three independent companies in three countries. To restore, you prove your identity — with a passport or national ID card — to two independent companies through the Ledger Wallet app.
It solves one real problem: losing your backup. It also introduces new ones: your identity becomes part of the key, and your security now depends on three companies, their identity checks and the legal systems they operate in.
For some people that’s a good trade. For others it’s the wrong tool entirely. This guide helps you work out which group you’re in.
How Ledger Recover Works
- You opt in from the Ledger Wallet app (the app formerly called Ledger Live) and start a subscription. There’s a one-month free trial, and you can cancel at any time.
- Your device creates an encrypted copy of your spare key inside the secure element — the tamper-resistant chip that holds your keys.
- The copy is split into three encrypted pieces, sent over encrypted channels and stored in hardware security modules by three independent companies in three countries. When the service launched in 2023, those were Ledger, Coincover and EscrowTech; Ledger’s current page describes them as three independent companies, with Coincover named as the service provider.
- Your identity is linked to the pieces. You verify with a passport or national ID card. Availability depends on the country that issued your document.
- To recover, you verify your identity online with two independent companies. Two pieces are returned to a Ledger device, which reconstructs the key.
Supported devices, according to Ledger’s page in October 2026: Nano X, Nano S Plus, Nano Gen5, Flex and Stax.
One gap matters a lot: Recover doesn’t back up your passphrase. If you use a passphrase-protected hidden wallet, Recover restores only the standard wallet. Ledger’s CEO pointed this out when the service was announced. Related: Hidden Wallets and Split Backups: How to Set Up a Passphrase and Multi-share Backup
Why It Caused an Uproar in 2023
When Ledger announced Recover in May 2023, the reaction was furious — and the anger wasn’t really about the service.
For years, hardware wallets had been sold on a simple promise: your recovery phrase never leaves the device. Recover showed that Ledger’s firmware could export an encrypted copy of it, if the user agreed. Many users felt the promise had been broken.
Ledger’s answer was that “there is no backdoor”, and that users had always had to trust its firmware anyway. On 23 May 2023, CEO Pascal Gauthier apologised for how the product was communicated, promised the service would be “fully optional”, and committed to open-sourcing more of Ledger’s operating system and the Recover protocol before launch. The service went live later that year.
The lesson is wider than Ledger. Any hardware wallet runs firmware written by its manufacturer, and you trust that firmware with your keys. Open-source firmware lets independent researchers check what it does; closed firmware asks you to trust the company. Recover didn’t create that trust relationship — it made it visible.
The Trade-Off in Plain Terms
| Risk Recover reduces | Risk Recover adds |
|---|---|
| Losing your paper or metal backup | Your identity documents become part of your recovery |
| Fire, flood or a house move destroying it | Three companies and their identity checks join your security model |
| Forgetting where you stored it | Legal requests in the countries where those companies operate |
| A single physical point of failure | Phishing that uses “Recover” as a pretext |
Two of those added risks deserve more attention.
Identity data leaks. Ledger’s customer data has leaked before: a 2020 breach exposed customers’ emails, and later names, phone numbers and home addresses. In January 2026, a breach at Ledger’s e-commerce partner Global-e exposed customers’ names, contact details and order information. Neither involved Recover data or recovery phrases. But each showed the same thing: when identity data about crypto holders leaks, phishing and physical targeting follow. Related: Your Data Is the Attack Surface: How Breaches, KYC and Tax Records Make You a Target
Phishing that borrows the name. A backup service tied to your identity is a perfect pretext for fake “verify your Recover account” emails, letters and calls. After the Global-e leak, phishing emails pushed a fake “device security update” within days.
Five Questions to Decide
1. Which is more likely: losing your backup, or being targeted?
If you’re disorganised, move house often, or have no secure place to keep a backup, losing it is your bigger risk, and Recover addresses it directly. If you’re well organised but known to hold crypto, targeting is the bigger risk, and Recover adds exposure.
2. How much is at stake?
For a modest amount, a convenient and recoverable setup can be the safer choice in practice. As the amount grows, so does the case for a setup that depends on no third party at all.
3. Is your identity already linked to your crypto?
If you buy through regulated exchanges, it largely is: exchanges know who you are, and from 2026 EU platforms report your activity to tax authorities under DAC8. Recover doesn’t create that link, but it adds a link between your identity and your self-custody wallet. Related: The First DAC8 Reporting Year Closes in December — What EU Crypto Holders Need to Do Now
4. Do you use a passphrase?
If so, Recover alone won’t restore your hidden wallet. You still need a separate, well-stored passphrase backup.
5. Who needs to recover — you, or your heirs?
Recover is built around your identity verification. It isn’t an inheritance plan. If your goal is making sure your family can reach your crypto, you need a different setup. Related: What Happens to Your Crypto When You Die
The Alternatives
A properly stored metal backup. It survives fire and water and depends on no company. Two copies in two locations remove most “lost backup” risk. Related: Metal Seed Backups: What Survives Fire, Acid and a 20-Ton Press
A multi-share backup. Split your backup into shares — for example, any two of three — stored in different places. No single share reveals anything, and losing one doesn’t lock you out. Trezor supports this natively. Related: Hidden Wallets and Split Backups: How to Set Up a Passphrase and Multi-share Backup
Ledger’s Recovery Key card. Ledger also offers a PIN-protected card that holds a copy of your backup and can restore it to compatible Ledger devices, without involving any outside company.
Multisig for large amounts. Several devices, ideally from different manufacturers, each hold one key, and a set number must sign. No single device, company or backup can move funds alone.
If You Use Ledger Recover, Use It Safely
- Set it up only from inside the Ledger Wallet app — never from an email, a letter, a QR code or a phone call.
- Ledger will never ask for your 24 words. Recover setup doesn’t involve typing them anywhere. Ledger also says it will never send you physical items or ask you to scan QR codes or visit websites.
- Keep a physical backup as well, unless you’ve deliberately decided otherwise. Recover is a spare key, not a replacement for a backup you control.
- Back up your passphrase separately if you use one.
- Expect phishing. Any message about “verifying” or “renewing” Recover deserves suspicion until you’ve checked inside the app.
Verdict
Ledger Recover is a legitimate answer to a real problem. Lost backups destroy far more crypto than broken encryption does, and for people likely to lose theirs, an identity-based backup can be the safer choice.
But it changes your security model from “nobody but me” to “me, plus three companies, plus my identity documents.” For larger holdings, people whose ownership of crypto is known, and anyone using a passphrase or planning an inheritance, a well-stored metal or multi-share backup does the same job without adding anyone else.
Frequently Asked Questions
Can Ledger access my crypto through Recover?
According to Ledger, each piece is encrypted, stored by a separate company, and released only after your identity has been verified by two independent companies. Whether that’s acceptable is a question of trust in the companies, their identity checks and their jurisdictions — which is why the choice belongs to you.
Is Ledger Recover mandatory?
No. It’s an optional paid subscription. Your device works the same without it.
Does Trezor offer something similar?
Trezor doesn’t offer a company-held backup. Its answer to lost backups is multi-share backup, where you hold all the shares yourself.
What happens if one of the companies is breached?
Ledger says each piece is encrypted and one piece alone isn’t enough to recover a key. The larger practical risk is identity data — which is why a leak of personal data about crypto holders matters even when no keys are exposed.
Can my family use Recover after I die?
Recover is designed around your own identity verification, not as an inheritance tool. Plan inheritance separately.
Transparency: TrueToCrypto may earn affiliate commissions from links in articles, including links to Ledger and Trezor. Recommendations are based on security merit, not commission rates. This article is educational and is not financial or security consulting advice.
Contact: info@truetocrypto.com
Sources: Ledger’s Recover product page (October 2026); Pascal Gauthier’s statement of 23 May 2023; Blockworks (May 2023); The Register (6 January 2026) on the Global-e incident. Verified October 2026.
