Ledger vs Trezor for DeFi and Where Each Falls Short

For signing on Ethereum and its layer 2s, Ledger and Trezor now decode transactions from the same shared ERC-7730 registry. At Trezor's September launch, the protocols in that registry covered 33.3% of the twenty largest Ethereum applications by capital. The real difference is in where the decoding runs and who has to cooperate for it to appear. Trezor does it in open-source firmware, automatically, on the Safe 3 as well as the Safe 5. Ledger has run Clear Signing since 2023, but it depends on the wallet or dApp integrating it, and in August 2026 Ledger patched two separate ways to defeat it.

That makes the choice less about the Flex against the Safe 5, or the Nano X against the Safe 3, than about which software a reader signs through. Within each brand, the published clear-signing record is the same for both devices. The brand is the decision. The device under it is a matter of budget and screen.

Several rows a buyer would expect are missing because the sources behind this page do not cover them. These include price, screen, secure element, Bluetooth, firmware licensing beyond Trezor's clear-signing pipeline, MetaMask and Rabby compatibility, Ledger Recover, and whether each device works as a signer on a Safe multisig. The same applies to Ledger's 2020 customer data leak and the 2023 Connect Kit attack. Neither is described here, because no primary source for either was part of this research. The research also turned up no published clear-signing flaw in Trezor's devices.

The Flex is a touchscreen signer. Ledger documents a second feature for that class of device, Transaction Check, which runs alongside Clear Signing. Ledger also wrote the standard both brands now use: it originated Clear Signing in 2023 and handed stewardship of ERC-7730 to the Ethereum Foundation on May 12, 2026.

The Flex was also the device on which the security firm TestMachine validated a clear-signing bypass, disclosed on August 21, 2026. An APDU race condition let a malicious dApp swap a reviewed transaction for a different one mid-signing, for example turning a small transfer into an unlimited token approval. Ledger's CTO, Charles Guillemet, said the Donjon team had found the flaw internally and fixed it on August 12 in Ethereum app 1.22.2. That patch came with no advisory. Guillemet called TestMachine's disclosure "not security research. That's manufacturing fear for attention." Six days later, Ledger published bulletin LSB-024 for a separate flaw. A 16-bit array count was stored in an 8-bit field, so for a 257-element array the review showed only the last element while the signature covered everything. That flaw was fixed in 1.22.3. As of August 24, no verified thefts had been traced to either flaw.

The Flex suits a reader who signs through Ledger Wallet over WalletConnect, or a wallet with a Ledger agreement, and keeps the Ethereum app current.

Trezor's Clear Signing launch puts the decoded action, tokens, amounts and destination on the Safe 5's screen without any setting to enable. It works the same way in Trezor Suite, WalletConnect and Trezor Connect. The entire pipeline is open-source firmware. Launch partners included 1inch, Aave, Benqi, Corestake, Ethena, Hyperliquid, Lido, LiFi, Lombard, OpenCover, YieldXYZ and Tether. Kiln and P2P are supported except for ETH vaults.

The limits are stated plainly by Trezor itself. Coverage depends on the registry, which Trezor does not control. Exploits caused solely by an inaccurate registry description are excluded from its bug bounty. The feature has also been public for about five weeks, which is not long enough to be tested the way Ledger's code has been.

The Safe 5 suits a reader whose DeFi runs through Suite or WalletConnect on the launch protocols.

The Nano X runs the same Ethereum app as the Flex, so it shares both the benefits and the history. It decodes the same ERC-7730 descriptors, and it was listed as potentially affected by the race condition through shared code. Ledger's documentation names Stax and Flex as touchscreen signers with Transaction Check and does not list the Nano X.

Ledger's model has one further constraint. EIP-712 typed messages, the format behind many permit signatures and off-chain orders, are clear-signed only when a descriptor exists for that specific domain. Without one, the device falls back to blind signing.

The Nano X suits a reader who wants Ledger's integration at the lower tier and does not need Transaction Check.

On clear signing, Trezor's own support guide makes no distinction between the Safe 3 and the Safe 5. Both need Universal firmware 2.12.4, both cover the same chains, and both fall back to the same hash and warning. The device the feature leaves out is the original Model One, which matters to anyone planning to keep an older Trezor for DeFi.

The Safe 3 suits a reader who wants Trezor's firmware-native clear signing and has no use for what the Safe 5 adds.

Integration. Ledger's decoded view depends on software outside the device. The wallet must embed Ledger's Device Management Kit. Full features need a Ledger-issued originToken. Ledger states that both wallet and dApp must support ERC-7730 for the view to display end to end. Trezor needs none of that from the wallet. A Ledger owner who signs through a third-party wallet without a Clear Signing agreement gets raw calldata. A Trezor owner on WalletConnect gets the decoded view.

Scrutiny. The strongest case for Ledger is that two disclosed bypasses show a codebase under attack, and that bugs found and fixed are better than bugs not yet found. That case has merit. Ledger's parser has had three years of exposure and a bug bounty that produced LSB-024. Trezor's has had five weeks. Nobody should read the lack of a Trezor disclosure as proof of safety. Still, the August episodes show something about Ledger that age does not excuse. One fix shipped without telling owners, so a Flex or Nano X owner had no notice to update until a third party went public.

Coverage. This is the factor that matters most, and it favors neither brand. Both read the same permissionless registry. A protocol without a descriptor is blind-signed on either, which is the case clear signing exists to replace. CryptoTicker's count found Lido ($23.90 billion) and Aave v3 ($14.58 billion) covered at Trezor's launch, while Uniswap ($2.43 billion across v2, v3 and v4) and Curve ($1.21 billion) were not. CryptoBriefing reported roughly 28% growth in published descriptors between May and July 2026, which is quick progress from a low base. Neither brand's screen does anything about an unlimited approval already granted.

A reader who signs through Trezor Suite or WalletConnect on Aave, Lido, 1inch or the other launch protocols should take a Trezor. On the published record the Safe 3 does the same clear-signing job as the Safe 5, so paying for the Safe 5 buys nothing on this front.

A reader already committed to Ledger Wallet, or to a third-party wallet with a Ledger Clear Signing agreement, loses nothing by staying with Ledger, provided the Ethereum app is at 1.22.3 or later. The Flex earns its place over the Nano X only for a buyer who wants Transaction Check on a touchscreen.

A reader whose capital sits mostly in Uniswap or Curve gains little from either brand's clear signing as of the September launch counts. That reader is in effect choosing between two ways of displaying the same hash.

Before any deposit, the check that matters is whether the protocol has a descriptor in the ERC-7730 registry. Without one, a $79 device and a flagship show the same thing.