EP - 99

Building the Future of Digital Asset Security

with

Carl Anderson & Mo Sayed
VP of Engineering & Head of Brand Development @ Ledger

Apr 09, 2025

On this episode of The Ledger Podcast, recorded on the second day of Ledger’s new 106 headquarters opening, host Mo Sayed speaks with Carl Anderson, Ledger’s VP of Engineering, about equipping third-party developers with tools to build with Ledger, securing the web3 ecosystem, and the future of digital asset security.

The new headquarters aims to be a vibrant hub for communities and builders, including renting out floors to other web3 companies like Flowdesk.

“I’ve never been in such a magnificent and great great office, so it actually tells a lot about our ambition to all the work that we’ve accomplished over the years”. I’d really like this to be a welcoming space for engineers for may they be with web3 or React or Scala, Python all those communities to come have meetups and so that we can actually build together right because we can’t do it alone”. – Carl Anderson

Key Highlights:

The Fundamental Principle: No Self-Custody Without Security

Blockchain enables self-custody, but as Carl notes, “with great power, comes great responsibilities.”

Laptops and phones aren’t secure for secrets. Ledger provides hardware devices, like real vaults for your seed phrase,” with bank-grade security via Secure Element technology.

Digital asset security relies on a key pair: public (address) and private (access key). Losing the private key means losing assets.

Ledger’s Three-Layer Security Architecture

Ledger’s hardware wallets are built on three core security properties:

Secret Storage: Ledger devices use a secure element chip, the same chip technology that has protected banking and government secrets in passports and credit cards for years, known for being laser proof” and “high security.
Integrity: The Ledger ecosystem makes sure that everything runs within a secure element. This means keys and algorithms remain isolated, preventing tampering or extraction, making devices completely malware resistant.
Trusted Display: All Ledger devices feature a screen controlled directly by the secure element. This trusted display allows users to always double check and know precisely what they’re signing at all times before confirming immutable blockchain transactions.
Clear Signing takes the screen’s critical role and makes it airtight in security.

“Whatever you’re doing on a blockchain is immutable; so you need to be able to know precisely what you’re signing at all times.” – Carl Anderson

Ledger uniquely develops all three components: the hardware, the operating system (Ledger Secure OS, formerly BOLOS), and the software.

Openness and the Developer Ecosystem

Ledger promotes an open ecosystem. Carl emphasized that Ledger wallets do not lock users into their system; even if Ledger disappeared, the hardware wallet would still be usable with other software wallets.

Key developer tools include:

Ledger OS SDK: Ledger OS SDK Allows developers to build blockchain apps on secure elements, a previously inaccessible capability.
Third-Party Apps: Approximately 90% of Ledger apps are built by third parties.
Device Communication SDK: Enables software wallets (e.g., Coinbase, Rabbi, Corbas, MetaMask) to communicate with Ledger devices.
Ledger Live Integration: Developers can integrate crypto projects into Ledger Live. Ledger Live is open source.

A comprehensive Developer Portal provides documentation, tools, and boilerplates for various development needs, all accessible online.

“Once you integrate it it’s not the end of the projects, actually (it is) the start because then suddenly real users in the real world will start using this code and so it needs to be maintained”. – Carl Anderson

The Clear Signing Initiative

Clear signing combats scams and blind signing. Scammers exploit complex hexadecimal displays on regular screens.

Ledger aims to improve security at use collaboratively across the ecosystem. It works by having dApps provide plain English metadata describing transactions, which wallets use to display clear information on Ledger devices before signing.

Currently, Ledger curates metadata via a centralized GitHub repo, but plans to decentralize this process. The roadmap began with defining metadata and building tools for Ethereum, expanding to advanced smart contract interactions, and then other ecosystems like Bitcoin, Solana, and Tron.

Ledger’s mission is to secure the entire Web3 ecosystem.

Innovations in Form Factor: Ledger Stax and Flex

Ledger’s new Ledger Stax and Ledger Flex devices feature a larger, touch-enabled e-ink screen that enhances user experience by simplifying transaction review and enabling personalization with NFTs or images.

This secure, low-power screen, unlike phone screens, prevents malware compromise. These devices also serve as FIDO2 authentication devices.

Security First: Addressing Open-Source Concerns

Carl Anderson clarifies that Ledger’s secure element code isn’t open source due to confidentiality agreements with providers like Microchip, which is crucial for protecting against physical attacks. He emphasized that “security is first,” with all other components like the device SDK, management kit, app kit, and Ledger Live being open source.

Watch the episode here:

Vision for the Future of Web3

Carl Anderson envisions a future where web2 Medieval Times (with scattered data and passwords across castles like Twitter and Amazon evolve into a modern era enabled by blockchain.

He sees self-custody as central to giving users control over their data and identity.

Carl’s 2034 vision: a password-less world using passkeys and crypto keys for authentication and data control.
Users will manage their identity and cross borders seamlessly.
Leverages Zero-Knowledge Proofs (ZKPs) for privacy-preserving attestations (e.g., citizenship proof without revealing the entire passport).
Uses NFTs for asset ownership (e.g., car or house titles with on-chain metadata).
Believes in the digitalization of various assets, from money to ownership titles.
Sees cryptographic proofs as a “counter-power” to AI, verifying humanity and controlling data.
Urges all developers to build technology for a “sustainable,” “decentralized” future where users regain control of their data and value.
Promotes blockchain adoption for web2 developers.

Reading List

Learn more about these topics mentioned in the episode, or explore our library of articles on Crypto, Security, and Regulation on Ledger Academy