<p>Keep in mind that the ledger itself, if compromised could leak the pk in other ways. These methods I outlined will only <strong>confirm to you that a given address belongs to the set of private keys you hold, not that you're the only person holding these pks</strong></p>

<p>like you said: one way you can cheaply verify that is to simply take the address and send a little bit of money to it. That does not answer if your key is compromised but it does tell you if the address belongs to your seed or not.</p>

<p>Another way would be to manually derivate the address from the private key using the BIP39 tool <a href="https://iancoleman.io/bip39/" rel="nofollow noreferrer">here</a> until you reach the address that ledger gave you.</p>

<p>This second one doesn't require you to send any money but it is more risky as you need to trust the code in the page I sent you and you're literally inserting your pk in a form in the web, which is never a good idea.</p>

<p>The third thing you could do is generate Private Keys with a method you trust (i.e. using Samourai wallet or something) and then use that mnemonic in the ledger as a seed. This way you know that only you have that private key.</p>

CC BY-SA 4.0
2019-02-22T14:31:08.300Z
Thank you for the answer. I believe that with everyone's comments I learned that using a ledger comes with a bit of trusting the company that manufactured it and there are a lot of different methods I could use to manage my private keys that are more trust less. Maybe that is the path my studies will take me next. Thank you again
João Grilo Bitcoinheiro
CC BY-SA 4.0
2019-02-23T16:57:28.677Z
it does. Trezor, on the other hand has it's firmware open sourced. If you really want to verify it, you can (I personally never tried nor do I know how to do that exactly). Here's their github: https://github.com/trezor/trezor-core
FKrauss
CC BY-SA 4.0
2019-02-22T08:10:54.533Z
2019-02-22T08:10:54.533Z
FKrauss
<p>I'm a paranoid newb, I bought a hardware wallet (Ledger nanos) and have transferred funds to it. I noticed that it generates P2SH addresses, so how could I know if the script hashed is spendable by my own wallet only?</p>

<p>The wallet could very well generate P2SH multisig addresses that could be spendable remotely by the wallet manufacturer.</p>

<p>I understand I could transfer these funds to myself and check the ScriptSig, but that would be too late.</p>

CC BY-SA 4.0
2019-02-21T22:13:06.503Z
The question title is a bit misleading because you really want to know how to know that your ledger wallet is secured, not really about the address or why it is or is not 'spendable'.
PW Kad
CC BY-SA 4.0
2019-02-21T22:35:27.890Z
This is why it is better to create your own addresses using a good source of entropy. I don't know if they release the source for the key generation, but you could check here: https://github.com/LedgerHQ
JBaczuk
<p2sh><multi-signature><hardware-wallet>
How do I know that my Ledger HW Wallet is using receive addresses for my wallet and not another remote wallet?
João Grilo Bitcoinheiro
# How do I know that my Ledger HW Wallet is using receive addresses for my wallet and not another remote wallet?

(Asked by: username_0 on 2019-02-21)

I'm a paranoid newb, I bought a hardware wallet (Ledger nanos) and have transferred funds to it. I noticed that it generates P2SH addresses, so how could I know if the script hashed is spendable by my own wallet only?

The wallet could very well generate P2SH multisig addresses that could be spendable remotely by the wallet manufacturer.

I understand I could transfer these funds to myself and check the ScriptSig, but that would be too late.

**Tags:** p2sh, multi-signature, hardware-wallet

> **Comments:**
> **username_1**: The question title is a bit misleading because you really want to know how to know that your ledger wallet is secured, not really about the address or why it is or is not 'spendable'.  
> **username_2**: This is why it is better to create your own addresses using a good source of entropy. I don't know if they release the source for the key generation, but you could check here: https://github.com/LedgerHQ  

---

## 1 answers

### Answer by username_3 on 2019-02-22. Score: 2 | Accepted answer

Keep in mind that the ledger itself, if compromised could leak the pk in other ways. These methods I outlined will only **confirm to you that a given address belongs to the set of private keys you hold, not that you're the only person holding these pks**

like you said: one way you can cheaply verify that is to simply take the address and send a little bit of money to it. That does not answer if your key is compromised but it does tell you if the address belongs to your seed or not.

Another way would be to manually derivate the address from the private key using the BIP39 tool [here](https://iancoleman.io/bip39/) until you reach the address that ledger gave you.

This second one doesn't require you to send any money but it is more risky as you need to trust the code in the page I sent you and you're literally inserting your pk in a form in the web, which is never a good idea.

The third thing you could do is generate Private Keys with a method you trust (i.e. using Samourai wallet or something) and then use that mnemonic in the ledger as a seed. This way you know that only you have that private key.

> **Comments:**
> **username_0**: Thank you for the answer. I believe that with everyone's comments I learned that using a ledger comes with a bit of trusting the company that manufactured it and there are a lot of different methods I could use to manage my private keys that are more trust less. Maybe that is the path my studies will take me next. Thank you again  
> **username_3**: it does. Trezor, on the other hand has it's firmware open sourced. If you really want to verify it, you can (I personally never tried nor do I know how to do that exactly). Here's their github: https://github.com/trezor/trezor-core  

---

