Ledger Team

Ledger was born in 2014 out of a very concrete problem: the first wave of crypto users were losing funds to exchange hacks, phishing attacks and plain human error. The founders — a team with deep roots in embedded security and smart cards — understood that the only way to truly own crypto was to hold your own private keys, and the only safe way to hold private keys was inside a tamper-proof piece of hardware. That insight wasn't theoretical. It came from decades of building secure chips for banking, passports and telecom. The moment was the realization that the same secure element technology protecting a billion credit cards could protect the keys to a new financial system.

For the founding team, the accident was being embedded-security experts at the exact moment Bitcoin arrived. These were people who had spent careers making chips resist physical and side-channel attacks. When they saw early crypto holders storing keys on laptops and USB sticks, it looked like a security crisis waiting to happen — and they happened to have the exact skill set to fix it. The accident was the collision of a deep hardware security background with a brand-new asset class that desperately needed it.

Ledger makes a small device — about the size of a USB stick — that holds the keys to your crypto and NFTs. Think of it as a personal, unhackable safe for digital money. Even if your computer is compromised, even if someone steals the device, they cannot reach your assets. We also build the app that lets you manage, buy, swap and stake those assets, and we build enterprise-grade custody for institutions. In one sentence: we make it possible to truly own your digital wealth without trusting a bank or an exchange.

Scale and ambition. In 2014 we were a handful of people shipping one product to a few thousand early adopters. Today we've sold over 7 million devices in 180 countries, we secure assets for both retail users and major institutions, and our ecosystem spans hardware, software, enterprise and developer tools. What hasn't changed is the core conviction: self-custody is the future of digital ownership, and hardware is the only way to make it truly secure.

The fact that we've never had a customer lose funds due to a device-level compromise. In over a decade, across more than 7 million devices, no one has extracted a private key from a Ledger device. That is an extraordinary record in an industry defined by breaches. It's the result of obsessive engineering — the secure element, the custom operating system, the constant audits — and it's the achievement the team is most proud of, even if it's the one users never hear about because it means nothing went wrong.

The problem is that digital assets are, by design, bearer instruments. Whoever holds the private key holds the asset. That's powerful — it removes intermediaries — but it's also dangerous, because it transfers all responsibility for security to the user. Most people are not security experts. They use shared computers, they click phishing links, they reuse passwords. The problem Ledger solves is making self-custody safe enough that an ordinary person can hold their own keys without becoming their own security engineer. The product — the hardware wallet — is just the vehicle. The problem is closing the gap between the promise of ownership and the reality of human error.

People think Ledger is a hardware company. We're a security company that happens to use hardware as its foundation. The device is only the first layer. The real product is the entire self-custody stack — the secure element, the operating system, the Ledger Live app, the integrations with DeFi and NFT platforms, the enterprise custody infrastructure. Hardware is where trust begins, but it's not where it ends. We're building an ecosystem where owning your keys is not just safe but actually easy.

Yes — because Ledger's relevance doesn't come from the absence of competitors, it comes from the existence of self-custody as a category. As long as people want to own digital assets without trusting a third party, there will be a need for hardware-grade security. The competitor that matters isn't another wallet company; it's custodial complacency — the temptation to leave your assets on an exchange. Our job is to make self-custody so accessible that the custodial default becomes the less attractive option.

Success looks like self-custody becoming the default, not the exception. It looks like tens of millions of people managing their digital wealth through Ledger — buying, swapping, staking, signing transactions across DeFi and NFTs — all from a device and an app that feel as simple as a banking app but without the bank. It looks like institutions running on Ledger Enterprise infrastructure as a matter of course. And it looks like the phrase 'not your keys, not your coins' finally being solved not by a slogan, but by a product so good that people choose ownership without being told to.

Our ideal customer is anyone who holds meaningful digital assets and wants to truly own them — from a first-time Bitcoin buyer to a global institution managing billions. The challenge is that the people who need self-custody most are often the least aware of it. A new user who bought crypto on an exchange doesn't know they should move it off. An institution may not realize there's a non-custodial alternative that meets their compliance needs. Education is the bottleneck — which is why Ledger Academy and content are as important to us as the devices themselves.

The idea that custodial solutions will simply win because they're easier. People assume convenience and self-custody are opposites, and that the market will gravitate toward the convenient option — which means custody. We believe that's wrong. The history of technology shows that secure defaults become convenient over time. HTTPS was once too hard for most websites. Two-factor authentication was once a power-user feature. Self-custody is on the same trajectory. The trend people are wrong about is assuming custody is the endpoint rather than a transitional phase.

Overhyped: the idea that AI will somehow replace the need for self-custody or make security irrelevant. AI is a tool, not a trust model. Underrated: hardware-based security for everything — not just crypto, but identity, credentials, personal data. The same secure element architecture that protects a Ledger device could protect far more of our digital lives. The underrated sector is hardware security as a category, which crypto is only the first use case for.

It needs to stop asking users to become security experts. The industry has spent years telling people to manage seed phrases, avoid phishing, verify addresses by eye, and understand gas fees. That's not a product strategy — that's a hazing ritual. Mainstream adoption means the security is invisible, the recovery is humane, and the interface is familiar. Crypto doesn't need more features. It needs fewer reasons for an ordinary person to fail.

Recovery. The seed phrase is the single greatest source of lost funds and the single greatest barrier to mainstream self-custody. If we could make recovery as safe as custody itself — without reintroducing a trusted third party — we would unlock self-custody for hundreds of millions of people who today stay on exchanges because they're afraid of losing their keys. That's the structural problem, and it's the one Ledger Recover is designed to address.

The concentration of assets on a small number of centralized exchanges. Every major exchange failure — and there have been several — has destroyed user wealth and user trust. The more assets sit on exchanges, the larger the systemic risk. What scares us is not a single hack; it's the possibility that a future failure is so large that it discredits the entire category of self-custody by association, even though self-custody is exactly what would have prevented the loss.

Software runs on general-purpose hardware that is, by design, exposed to whatever runs on it. If your computer is compromised — and many are, without their owners knowing — any software wallet on that machine is compromised too. A secure element is a dedicated, tamper-resistant chip designed to do one thing: hold secrets and perform cryptographic operations without ever exposing the key, even to the device it's connected to. It resists physical attacks, side-channel attacks, fault injection and temperature manipulation. Software cannot do this because software has no physical boundary. The secure element is that boundary.

BOLOS — the Blockchain Open Ledger Operating System — is the custom OS that runs inside the secure element. It isolates each app in its own environment, so a compromised app cannot reach another app's keys. It enforces that every transaction must be physically confirmed on the device. And it ensures the private key never leaves the chip — not to sign, not to display, not to back up. BOLOS matters because the secure element is only as trustworthy as the software running on it. A secure chip with insecure software is just an expensive paperweight. BOLOS is what makes the chip actually secure.

Blind signing is when a hardware wallet approves a transaction without showing you exactly what you're approving — it just asks 'sign yes or no.' That's how users get tricked into signing malicious transactions, because the wallet can't tell them what the transaction actually does. Clear signing means the device decodes and displays the full details of the transaction — who you're sending to, how much, what contract you're interacting with — before you confirm. Ledger has invested heavily in clear signing across DeFi and NFT protocols because it's the difference between a hardware wallet that protects you and one that just gives you a false sense of security.

Every Ledger device undergoes a secure manufacturing process, and each device generates its private key on-chip at first initialization — the key is never injected, never present on our servers, never transmitted. We also publish a genuine check that lets users verify their device is authentic and has not been tampered with. The secure element itself is sourced from certified manufacturers with tamper-evident packaging. Supply chain security is about assuming every link could be attacked and building verification at every step.

A hardware wallet protects your keys — it does not protect you from being tricked. If you willingly sign a transaction that drains your wallet, the device will execute it, because the device's job is to sign what you confirm, not to judge your intent. This is why clear signing, address verification and education matter so much. The hardware is the last line of defense, not the first. The first line is an informed user who understands what they're signing.

The convergence of hardware and software into a single, seamless self-custody experience. Ledger Live has evolved from a companion app into a full gateway — buy, swap, stake, manage NFTs, connect to DeFi, all with the hardware signing in the background. What excites us is that the user no longer has to choose between security and capability. They get the full power of Web3 with the security of a secure element. That convergence — making the secure path the easy path — is the most exciting thing we're building.

The Ledger Stax. When we announced a hardware wallet designed by Tony Fadell — the designer of the iPod — with an e-ink curved screen and a premium price, some people questioned why a security company was investing in industrial design. The answer is that security products that people don't want to use don't protect anyone. If a device feels like a punishment, users leave their assets on an exchange. The Stax and the Flex are a bet that the best security product is one people are proud to own and easy to use every day. That surprised people who thought security and design were separate concerns.

The Ledger Recover feedback in 2023. When we introduced an optional seed recovery service, a segment of the community reacted strongly — they were concerned that any path to key recovery, even optional and encrypted, compromised the promise of self-custody. We listened, paused, and rebuilt the product with far more transparency about the cryptographic architecture — sharding the seed across independent providers, with no single party able to reconstruct it. That feedback reshaped not just the product but how we communicate about trust. It taught us that in self-custody, the perception of security is part of the security itself.

We don't build anything that requires us to hold the user's keys. That's the bright line. We could build a far simpler product if we custody the keys — no secure element, no seed phrase, no recovery complexity. But that would make us a bank, and the world already has banks. Everything we build has to preserve the property that the user is the only one who can authorize a transaction. If a feature requires breaking that principle, we don't build it, no matter how convenient it would be.

That hardware wallets will eventually be invisible — embedded in phones, laptops and identity systems — and that the standalone hardware wallet is a transitional form. The contrarian view is that we're building toward a world where you don't buy a hardware wallet; you just have one, because secure elements are everywhere. The standalone device is the necessary first step, but the destination is hardware security as a default layer of every computing device.

That a software wallet on a phone is 'good enough.' It is not. A phone is a general-purpose computer connected to the internet, running dozens of apps, receiving messages and links constantly. It is, by definition, an attack surface. A hardware wallet isolates the keys from that entire environment. The misconception is that convenience and security are a spectrum and you can pick a middle point. With private keys, there is no middle point — either the key is isolated or it isn't.

The 2020 customer data breach was the hardest moment in the company's history. Attackers compromised our e-commerce and marketing database, exposing the contact details of roughly a million customers. No private keys were affected — the breach never touched our hardware or our signing infrastructure — but the human cost was real: customers faced phishing and, in some cases, physical threats. We learned that securing the product is not enough; you have to secure every system that touches the customer, and you have to communicate transparently when something goes wrong. That experience reshaped our entire approach to data minimization and incident response.

Traditional finance centralizes risk — it puts it inside institutions that are regulated, audited and insured, and the customer trusts the institution. Crypto decentralizes risk — it puts it directly in the hands of the user. We don't think one is better than the other; we think they serve different needs. Our job is to give the user the tools to manage decentralized risk as responsibly as an institution manages centralized risk. That means hardware for custody, clear signing for transactions, education for judgment, and recovery for resilience. The difference is that we're building infrastructure for the user, not for the bank.

Three things. First, move your assets off exchanges if you hold meaningful amounts — an exchange is a counterparty, not a vault. Second, buy a hardware wallet from the official source, never from a reseller or a second-hand market, because a tampered device can be pre-loaded with a known seed. Third, write your seed phrase on paper, store it offline, and never type it into any device — not a phone, not a computer, not a website. If you do those three things, you've eliminated the vast majority of ways people lose crypto.

Trust in crypto doesn't disappear — it shifts. You stop trusting an institution and start trusting cryptography, code and your own hardware. 'Trustless' means you don't have to trust a person; it doesn't mean you don't have to trust anything. You trust the secure element, you trust the signing logic, you trust the audit. Our job is to make those things worthy of trust — through open code where possible, through independent audits, through years of a track record with no device-level compromise. Trust is earned, not eliminated.

Regulation has pushed us to build for both worlds. On the retail side, we've always been non-custodial, which means we're largely outside the perimeter of many custodial regulations — we don't hold user funds. On the enterprise side, regulation has been a tailwind: institutions need custody infrastructure that meets compliance standards, and Ledger Enterprise is built to serve that. MiCA in Europe has given us a clearer framework to operate within, and we've invested in compliance because we believe regulated self-custody is the long-term winning model — not custody, and not unregulated self-custody, but compliant infrastructure for ownership.

Both, and that's not a contradiction. Bad regulation slows innovation by forcing builders to spend on compliance rather than product. Good regulation protects users by setting minimum standards for the institutions that hold their assets. The crypto industry has suffered enough from unregulated custodial failures that we can't honestly say all regulation is harmful. The question is whether regulation is written to enable self-custody or to entrench custody. We advocate for the former — regulation that recognizes non-custodial products as a legitimate, lower-risk category.

Europe, with MiCA, has done more than most to create a coherent framework that distinguishes between custodial and non-custodial models. France, our home market, has been thoughtful about fostering crypto innovation while maintaining standards. We also see promising approaches in jurisdictions that recognize that hardware-based self-custody is fundamentally different from exchange custody and should be regulated accordingly. The regulators getting it right are the ones who understand that not all crypto activity is the same, and that ownership is a feature to be encouraged, not a risk to be contained.

Clear recognition that non-custodial products — hardware wallets, self-custody software — are not financial intermediaries and should not be regulated as if they hold user funds. Today, much regulation is written for custodial exchanges and then applied, awkwardly, to non-custodial tools. A clear, principles-based distinction would unlock enormous innovation, because it would let builders create self-custody products without the compliance burden of a bank. It would also protect users, because it would make clear who is responsible for what.

They're not opposites — they're different layers. Decentralization is a technical property of a network; compliance is a legal property of a service. A decentralized network can be used by a fully compliant service. The mistake is thinking that compliance requires custody — it doesn't. You can build a compliant product on a decentralized network where the user keeps their keys. That's the model we believe in: compliant self-custody. It's not a compromise between decentralization and regulation; it's the best of both.

It's real where it intersects with security, and hype where it's just a token narrative. The real intersection is using AI to detect malicious transactions, to help users understand what they're signing, and to monitor for phishing and social engineering at scale. The hype is the idea that AI will somehow custody assets or replace the need for hardware security. AI is a layer of intelligence on top of infrastructure; it is not the infrastructure itself. We're investing in AI where it makes the user safer, not where it makes a good story.

Secure hardware. Everyone talks about L2s, ZK proofs and new consensus mechanisms — and those matter — but the single most underestimated technology is the secure element, because it's the only thing that has actually, provably protected user funds at scale for a decade. It's not glamorous, it's not a token, but it works. The industry underestimates it because it's physical and unsexy, and overestimates software-only solutions because they're easier to ship.

Account abstraction and smart-contract wallets that integrate with hardware. The combination of a hardware-secured key with a programmable account layer — where you can set spending limits, recovery rules and multi-signature policies — is the bridge between the security of cold storage and the flexibility of a smart account. That's the architecture that will make self-custody viable for the next hundred million users, and it's where the most interesting work is happening.

In transaction security. A hardware wallet signs what the user confirms, but the user needs to understand what they're confirming. AI can decode a complex DeFi transaction, explain it in plain language, and flag suspicious patterns — all before the user presses confirm. That's a natural intersection: AI as the translator between the complexity of smart contracts and the judgment of a human holding a hardware wallet. It doesn't replace the hardware; it makes the hardware more usable.

The 2020 data breach taught us that a security company has to be secure in every dimension, not just in the product. We had world-class hardware security, but our e-commerce systems were not held to the same standard. The lesson was that your security is only as strong as the weakest system that touches your customer. After that, we rebuilt our data practices around minimization — if we don't need to hold customer data, we don't hold it. The mistake was thinking product security was enough. The lesson was that trust is holistic.

The initial rollout of Ledger Recover in 2023 was, in communication terms, a failure — even though the technology was sound. We underestimated how much the community needed to understand the cryptographic architecture before accepting the concept. We built a secure product and then explained it poorly. The lesson was that in self-custody, transparency is not a marketing layer — it's part of the product. If users don't understand how a feature works, they can't trust it, and if they can't trust it, it doesn't matter how secure it is.

That education is not adjacent to the product — it is the product. For years we focused on building the best hardware and assumed users would understand why it mattered. We lost years to the gap between how good the product was and how well people understood it. If we had invested in Ledger Academy, in clear signing, in plain-language explanations earlier, adoption would have been faster. The lesson is that a security product people don't understand is a security product that doesn't get used.

Assume every system will be attacked, not just the obvious ones. The younger version of the company focused on the device — the secure element, the signing path — because that was the core. But the attacks came through the periphery: the e-commerce database, the marketing emails, the social engineering. I'd tell our younger selves: secure the whole surface, not just the crown jewels, because attackers don't aim for the strongest point — they aim for the weakest one that leads to the customer.

That in security, you are never done. There is no product you ship and then move on from. Every device we've ever sold is still out there, and it has to remain secure against attacks that didn't exist when it was built. That means continuous firmware updates, continuous audits, continuous monitoring. Security is not a launch; it's a commitment that lasts as long as the device is in use. That's the hardest lesson — and the one that defines what it means to be a security company.

Start with the threat model, not the technology. Before you build anything, ask: who is the attacker, what do they want, and what are they willing to do to get it. Every security decision flows from that. If you start with the technology — with the chip, the OS, the cryptography — you'll build something impressive but possibly irrelevant. If you start with the attacker, you'll build something that actually protects people. That's the discipline that separates security engineering from engineering.

The cypherpunk tradition — the idea that cryptography is a tool for individual sovereignty, not just for institutions. That lineage, from the 1990s through Bitcoin, is the intellectual foundation of self-custody. Beyond that, the practical influence comes from the embedded-security world — the engineers who spent decades making chips resist attacks for banking and identity. Ledger is the intersection of those two traditions: the cypherpunk conviction that you should own your keys, and the engineering discipline to make that ownership actually safe.

The original Bitcoin whitepaper, for the elegance of solving trustless consensus. Beyond that, the broader literature on secure hardware and side-channel attacks — the body of work from the smart card industry — shaped how we think about physical security. On the philosophy side, the writing on self-sovereignty and the importance of not outsourcing your own agency. It's a mix of technical and philosophical influences, because Ledger sits at the intersection of both.

Building custody. It's the path of least resistance — you can build a custodial product in weeks, raise money easily, and show growth quickly, because custody is convenient for users. But every custodial product is a future failure waiting to happen, because you're now a target holding other people's money. The repeated mistake is optimizing for short-term growth by taking on a long-term risk that will eventually destroy the company. The founders who last are the ones who build the harder, less convenient thing — self-custody — because it's the thing that doesn't blow up.

The new user who just bought their first crypto and still holds it on an exchange. That person is one phishing email, one exchange failure, one market panic away from either losing everything or becoming a lifelong self-custody advocate. If we can reach that person at the right moment — with a product simple enough to use and an explanation clear enough to trust — we convert them from a custodial user into an owner. That's the person who matters most, because there are hundreds of millions of them.

Self-custody is the difference between owning an asset and having a claim on an asset. When you hold your keys, the asset is yours — no one can freeze it, no one can lend it out, no one can lose it for you. When you leave it on an exchange, you have an IOU. History has shown, repeatedly, that IOUs in crypto are not always honored. What's at stake is the entire premise of crypto: that you can be your own bank. If everyone chooses custody, crypto becomes the same system it was supposed to replace. Self-custody is what makes crypto actually crypto.

By moving the complexity into the product, not the user. The secure element handles the key management. Clear signing handles the transaction decoding. Ledger Live handles the interface. The user's job is reduced to: confirm on the device what they want to do. We absorb the complexity so the user doesn't have to. The mistake the industry made for years was asking the user to be the security layer. Our approach is to make the product the security layer, so the user can just be the user.

The seed phrase is the ultimate backup — it's the human-readable form of your private key, and it's the one thing that can recover your funds if your device is lost or destroyed. That's why it must be written down, kept offline, and never entered into any digital device. The seed phrase is both the most powerful and the most dangerous thing in self-custody: powerful because it's the only thing that can restore your wallet, dangerous because anyone who sees it can steal everything. Treat it like the deed to your house — physical, private, irreplaceable.

Ledger Recover is an optional service that shards your seed into three encrypted fragments, stored with independent providers, so that if you lose your device and your seed phrase, you can still recover your wallet — without any single provider being able to reconstruct the key. It's a response to the fact that seed loss is one of the largest sources of lost crypto. It doesn't replace the seed phrase; it's a safety net for users who want one. And it's entirely optional — if you prefer pure self-custody with no third party involved, you simply don't subscribe. The point is to give users a choice between absolute independence and resilient recovery, without forcing one model on everyone.

As the security layer for digital ownership — not just crypto, but identity, credentials, tokenized assets and personal data. We see a world where a Ledger device, or a Ledger-secured element inside another device, is the trusted root for everything you own digitally. In five years, we expect tens of millions of users managing not just coins but their entire digital footprint through Ledger-secured infrastructure. The hardware wallet is the beginning; the destination is a world where owning your digital life is as natural as owning your physical wallet.

Institutional self-custody. Everyone assumes institutions want custody — that they want someone to hold their assets for them. But a growing class of institutions want to hold their own keys, with enterprise-grade infrastructure around them — multi-signature policies, compliance reporting, role-based access — but without surrendering the keys to a third party. That's a massive, underserved market, and it's the one Ledger Enterprise is built for. The opportunity is that 'institutional' and 'self-custody' are not opposites, and the market hasn't fully realized that yet.

That most of the user losses in crypto are not the fault of the technology — they're the fault of the industry's refusal to make security usable. We've built extraordinary protocols and then asked users to navigate them with the security maturity of a 1990s password field. The industry doesn't want to hear that the bottleneck to adoption isn't scalability or regulation — it's that the average person cannot safely use what we've built. Until we fix that, every other advance is built on a foundation of user loss.

Own your keys. It's the single most important thing you can do in crypto. Not because it's easy — it isn't, yet — but because it's the only way to be sure that what you've earned is actually yours. Use a hardware wallet. Verify what you sign. Write down your seed phrase and keep it offline. These are simple habits, and they are the difference between participating in crypto and actually benefiting from it. The future of digital ownership belongs to the people who hold their own keys. Make sure you're one of them.

Bringing hardware-grade security to identity and personal data. The same architecture that lets you hold your own Bitcoin could let you hold your own identity — credentials, attestations, personal records — without surrendering them to a platform. That's the next frontier, and it's the one we're most excited about. Crypto was the first use case for self-custody. It won't be the last.

Track record. We have over a decade of securing private keys with no device-level compromise, across more than 7 million devices. That's not a marketing claim — it's a security record, and in this industry, a security record is the only credential that matters. Competitors can match our features, but they can't manufacture a decade of not being breached. That's the advantage, and it's the one we protect most carefully, because it's the one that takes the longest to rebuild.

By assuming we're always under attack. We run continuous red-team exercises, we maintain a public bug bounty program, we subject our hardware and software to independent audits, and we design every system with the assumption that some part of it is already compromised. Paranoia isn't a mood — it's an engineering discipline. It means defense in depth, least privilege, and the assumption that a single failure should never be catastrophic. The day a security company stops being paranoid is the day it stops being a security company.

NFTs and DeFi integrations. When we first built Ledger Live, we expected it to be primarily a storage and send-receive tool. What we saw was users wanting to interact with DeFi protocols, manage NFTs, stake across networks — all from their hardware wallet. The appetite for self-custody that's also functional — not just cold storage but active participation — grew far faster than we projected. That's why we've invested so heavily in clear signing and DeFi integration: the user told us they want to do more from their hardware wallet, and we had to keep up.

Both, depending on the jurisdiction. In Europe, MiCA has been a roadmap — it's given us a clear framework to operate within and to build enterprise products that meet a known standard. In other markets, regulation has been a moving goalpost, with rules changing faster than products can be built. The helpful version of compliance is when the regulator defines the destination and lets builders get there. The unhelpful version is when the rules change after you've arrived. We prefer to build in jurisdictions that offer the first kind.

The depth of our enterprise infrastructure. Most users know Ledger for the Nano — the consumer device. They don't see the institutional custody platform, the multi-signature governance, the compliance and reporting tools, the integrations with prime brokers and trading venues. Ledger Enterprise is a substantial business serving some of the largest institutions in digital assets, and most retail users have no idea it exists. That's fine — they don't need to. But it's the part of Ledger that's quietly building the infrastructure for the institutional adoption of self-custody.

A user buys crypto and it lands directly in a Ledger-secured account — no exchange custody, no transfer step, no 'move it to cold storage later.' From the moment they acquire an asset, it's theirs, secured by hardware, managed through an app that's as simple as a banking app but with no bank in the middle. They can stake, swap, send and sign, all with the security of a secure element and the simplicity of a single confirmation. That's the ideal: ownership by default, security by design, complexity invisible.