Ledger has added real-time threat detection to its wallet software, a feature it calls Transaction Check. The company announced the tool in a post on August 22, 2026, describing it as a system that inspects each Ethereum transaction and warns the user before they approve it. The check runs at the point of signing, which is where most wallet losses actually happen.
The pitch is simple. Every time a Ledger user is about to sign an Ethereum transaction, the wallet screens what that transaction will do and surfaces a warning if it looks dangerous. Malicious token approvals, transfers to addresses linked to known scams, and interactions with flagged contracts are the kind of thing the feature is built to catch.
The signature is where wallets get drained
A hardware wallet's core promise is that private keys never leave the device. That protects against remote key theft, but it does nothing about the most common failure mode in crypto today: the user willingly signs a malicious transaction. Phishing sites, fake airdrops, and spoofed dApp front-ends all work the same way. They get a victim to approve a transaction that looks routine but hands over spending permission or drains a balance outright.
Approval scams are the clearest example. A user connects to what looks like a legitimate app, signs a token approval, and unknowingly grants an attacker unlimited permission to move a specific token out of the wallet. The theft can come minutes or months later. Nothing about the key was compromised. The user simply authorized the wrong thing.
Transaction Check attacks that gap by reading the transaction before the signature and translating raw calldata into a readable verdict. Instead of a screen full of hex, the user sees whether the action is safe, suspicious, or outright hostile. That framing matters because most people cannot parse a raw Ethereum transaction, and attackers rely on exactly that.
Real-time detection is now table stakes for wallets
Ledger is not first to this idea. Transaction simulation and threat feeds have become a standard layer across the wallet market, with security firms supplying the intelligence that flags malicious contracts and addresses. MetaMask and other major wallets have shipped similar pre-signing warnings, and the broader trend points to detection moving directly into the signing flow rather than living in a separate scanner a user has to remember to visit.
For Ledger, the move reflects a shift in what a hardware wallet is expected to do. Cold storage alone no longer answers the threats users face, because the attacks have moved from stealing keys to manipulating decisions. A device that only guards the key while leaving the user to interpret hostile calldata on their own is solving last decade's problem.
The company frames this as protection for its Ethereum users specifically, which is where the density of DeFi activity, token approvals, and smart-contract interactions makes the risk highest. Bitcoin transactions are comparatively simple to reason about. Ethereum's programmability is exactly what makes malicious transactions hard to read and worth screening.
A second set of eyes, not a guarantee
Real-time checks reduce risk, they do not remove it. Threat detection depends on the quality and freshness of the data behind it. A brand-new scam contract deployed minutes ago may not be flagged yet, and sophisticated attackers actively design transactions to look benign to automated screeners. Treating a green "safe" result as a guarantee is the wrong lesson to take from a tool like this.
The right posture is the same as it has always been for self-custody setups: read what you are signing, verify the contract and the recipient, and revoke old token approvals you no longer use. Transaction Check is a second set of eyes at the moment of decision, not a replacement for the first set. Used that way, it closes one of the widest gaps in everyday wallet security.
For users who spend from their own wallets rather than a custodial balance, the signing screen is the last line of defense, and it is the one attackers have learned to target. Moving detection into that screen is a sensible response to where the money is actually being lost.
Overview
Ledger has rolled out Transaction Check, a real-time threat detection feature that scans Ethereum transactions and warns users before they sign. It targets phishing, malicious approvals, and interactions with flagged contracts, the attacks that drain hardware wallets even though the keys are never exposed. The feature reflects a market-wide shift toward pre-signing detection, but it depends on threat-data freshness and does not replace the basic discipline of verifying every transaction before approving it.
