Cowrie Research

ledger-primary-sources-2026-06-16

5 min read

Ledger primary-source snapshot

Fetched: 2026-06-16 UTC

1) Official homepage

Source: https://www.ledger.com/

Selected excerpts from the official site:

Meet the all new Ledger Wallet™ 4.0 to buy swap, stake and build easier than ever

8+ million signers sold

Get a Ledger hardware wallet. It stores your private keys in a secure, offline environment giving you peace of mind and complete control over your assets. All Ledger crypto wallets are powered by an industry-leading Secure Element chip, together with Ledger’s proprietary OS that protects your crypto & NFTs from sophisticated hacks.

Additional signals from the source:

  • The homepage positions Ledger as a combined device-plus-app stack rather than just a device vendor.
  • The product framing is broad consumer wallet infrastructure across many assets and use cases, not a Bitcoin-only or narrowly airgapped signer story.
  • The Secure Element plus proprietary-OS language is important because it is one of the clearest first-party statements of Ledger’s preferred security tradeoff.

2) Ledger Wallet / formerly Ledger Live page

Source: https://shop.ledger.com/pages/ledger-wallet

Selected excerpts from the official site:

One crypto app to rule all. Total ease and control.

Ledger Wallet™ lets you build your portfolio: buy, swap, stake, spend* with the simplicity of exchanges & security of a signer.

Manage 15,000+ crypto all in one user friendly dashboard

Additional signals from the source:

  • The companion app is clearly the operational center of the ecosystem, not just a firmware-updater utility.
  • The page emphasizes portfolio management, third-party service access, and multi-chain asset management, which helps classify Ledger as a full wallet-control stack around the device.

3) GitHub organization

Source: https://github.com/LedgerHQ

Selected excerpts/signals from the official org:

  • The org page says Ledger combines its signer hardware with the Ledger Wallet app and notes the product renaming from Ledger Live to Ledger Wallet and from hardware wallet to signer.
  • The org highlights the ledger-live monorepo, wallet-api, and per-chain app repositories such as Bitcoin and Ethereum.
  • The repo inventory makes it clear that Ledger is not just shipping firmware blobs. It maintains app surfaces, integration tooling, chain apps, and a broader developer platform.

4) Ledger Wallet monorepo

Source: https://github.com/LedgerHQ/ledger-live

Selected excerpts from the official repo:

ledger-live is a monorepository whose purpose is to centralize all the JavaScript code related to the Ledger Live applications in one place.

Ledger Live is our platform of apps and services designed specifically for seamless integration with your Ledger device. Acting as a secure gateway to the crypto ecosystem, it allows direct access to a diverse range of crypto, NFT and DeFi services.

Additional signals from the source:

  • The monorepo includes desktop and mobile applications plus shared libraries and developer-facing packages.
  • The repo and linked developer docs show Ledger operating a broad software platform around the device rather than only a signer firmware project.

5) Developer portal: device interaction

Source: https://developers.ledger.com/docs/device-interaction/beginner/exchange_data

Selected excerpts from the official docs:

In this guide, you’ll learn how to send commands to a connected Ledger device and process the responses using the Device Management Kit (DMK).

APDU (Application Protocol Data Unit) commands are the low-level protocol used to communicate with Ledger devices.

Additional signals from the source:

  • Ledger exposes a fairly formal device-integration stack, including low-level APDU access, higher-level command wrappers, and device-action flows.
  • This reinforces that Ledger is an application platform and developer-integration surface, not just a sealed consumer gadget.

6) Developer security requirements

Source: https://developers.ledger.com/docs/device-app/integration/requirements/security

Selected excerpts/signals from the official docs:

  • Ledger requires every app to declare minimal permissions and coin-specific derivation paths in the Ledger app database.
  • The docs say Ledger will not deploy an app if permissions and derivation paths are not properly registered.
  • The docs also require explicit user approval for signing and say blind signing should be disabled by default.

Why this matters:

  • These pages show that Ledger’s control surface is partly the app-distribution and policy layer: app permissions, derivation-path rules, deployment gating, and signing-policy defaults are not incidental details.

7) Ledger on open source / Secure Element tradeoff

Source: https://www.ledger.com/blog-ledger-is-95-opensource-why-not-100

Selected excerpts from the official site:

Contrary to annoying FUD you may read on Twitter placed by competitors with inferior architectures, Ledger’s Operating System and Software are 95% OpenSource and/or available for you to review here:

Our choice of a secure element chip based on smartcard technology impacts our ability to be 100% OpenSource.

Our agreement with the maker and provider of this chip, STMicroelectronics, legally prevents us from exposing the low-level code that talks to the hardware blocks of the Secure Element.

Additional signals from the source:

  • Ledger is explicit that it prefers Secure Element-based hardware security even at the cost of keeping some low-level code closed.
  • That tradeoff is one of the most important distinctions between Ledger and more fully open signer stacks like Trezor or Foundation.

8) Ledger OS / BOLOS page

Source: https://www.ledger.com/academy/security/our-custom-operating-system-bolos

Selected excerpts from the official site:

Ledger hardware wallets use a tamper-proof chip called a Secure Element. This chip runs a custom operating system named Ledger OS™.

Ledger devices are multi-application by design. Anyone can design an app, and each app operates separately from one another.

Additional signals from the source:

  • The Ledger OS page frames the company as an app-platform operator with isolation, root-of-trust, and secure-screen claims, not merely a seller of signing devices.
  • The multi-application and app-isolation posture is an important comparison point against more monolithic firmware or narrower Bitcoin-only signer designs.

Notes

  • Ledger appears best cataloged as hardware-wallet infrastructure / signer-and-companion-app stack / Secure-Element wallet platform / developer integration and app-distribution surface.
  • No canonical standalone Ledger whitepaper or litepaper surfaced in this pass.
  • The most useful primary sources were the official homepage and app pages, the GitHub organization and monorepo, the developer portal, and Ledger’s own explanations of the Secure Element / open-source tradeoff.

Graph View