Ledger Tracks Explained | Etienne Waldron & Oscar Chaix at ETHOnline 2026

Transcript

Introduction to Ledger Agent Security

[music] Hello everyone and welcome to the Ledger workshop. Uh we are Eten Walden, myself and Oscar Sheeks next to me. We're both product managers uh at Ledger and working on the AI initiatives for Ledger. Um so yeah, let's let's dive in. Um so here's briefly the agenda for today. We'll talk a little bit about Ledger, not too much. Uh we'll talk about trust for agents right after that. Um Oscar here will present some of the tools that we have that are available for you to try. Um and we'll present the tracks at the end, the ones you'll be hacking on during the whole duration of

Meet Etienne Waldron and Oscar Chaix

this hackathon. Um so a bit about Ledger first. Uh Ledger is a French company was created in France in 2014. Uh we make hardware devices that help you secure your cryptocurrencies. Um today we secure roughly 20% of the world's crypto assets and we have sold uh over 8 million of these devices so far. Um the title here says secure by design and um if you look at the image on the right here you can see that there's a chip inside the device called the secure element and we have the screen that sits immediately on top of this chip. So what this means is um the data that is shown on your on your ledger device is cannot be tampered with and what you see is essentially what you sign and this will be

Ledger Hardware and Secure Elements

meaningful for the rest that we'll see today. Um so I'm sure you're very familiar with our set of products and you know they are used to secure cryptocurrencies but it turns out the architecture and the way we do our devices is also very appropriate for the agentic era. Um so ledger actually is also the trusted infrastructure for the agentic era the one we we're in right now. Um and this is quite a powerful sentence at the top here but you know anything that can act for you can also be turned against you and this is this is obviously very important in in today's uh times. Um obviously we have prompt injections that are possible. um models can of course hallucinate even though

Security Risks in the Agentic Era

they tend to hallucinate less and less and your secrets that may be stored in plain text environment files um can also be leaked. So a lot of things to worry about in the agentic era and we'll see a bit how how Ledger can be a solution to all of this. Um so essentially the way we believe at leger uh should be done is that agents should propose actions but you as a human should be approving them. The hardware signs. So um obviously the private key never should leave the uh secure element never leaves your device.

Human Approval and Hardware Signing

Um and you should be able as a human to understand what you're about to sign on the screen. and uh everything you know everything that matters that that's critical needs a human um a physical confirmation from a human. So that's kind of the model here that we're talking about. Um and Oscar now is going to talk about the whole stack behind what I just mentioned. >> Yep. Thank you and hey everyone. Uh so on the agentic side of things we've released a few products already and and I'm going to describe them just now. The first one is CLI. So they allow you to essentially interact with our platforms whether it be ledger wallet or ledger enterprise services or even enterprise multisig but directly from uh your

Ledger Wallet CLI for AI Agents

preferred agent. So if you're using codeex or using cloud code or any other uh agent um um that has access to a terminal you're able to use that to automate certain things you will do by hand on our apps and also trade with your um device security. So a few example here you can ask your agent to read your portfolio and and then ask it to lock 20% of it in in a in a bitcoin by clear signing on the device. Uh if you have certain targets for for each assets you can uh you can provide those targets to the AI and as it has access to those different positions it can propose optimized swaps to you as the as

the user. you just have to plug and and confirm on your device. Or you can also do things that are a bit outside of what we usually do in our apps. You can check for the re recipients unchange history. You can also optimize perhaps gas fees um by asking your agent to crunch numbers that you know you you wouldn't want to do on your own. So that's what we started to release in May. Since then, we've added a few capabilities I'm going to demo in in the next uh in the next slide. Um you can also teach an agent to sign. So that's the second pillar. Um that's a bit broad but in um in a in a nutshell um we have a an SDK called the device management kit and we

Device Management Kit Skills

have now created skills that allows any agent to essentially integrate it in your app or on any form of a of a of page or workflow that uh that you can think of. So um you know something that used to take um days if not weeks currently takes 10 minutes. Just ask your agent read those skills and please integrate ledger to uh to my uh to my wallet or require ledger confirmation before my bot sends anything. Um you can also think about non-crypto use cases for that one because it uh it comes with um the support of applications like ledger security key which is essentially a 502 2FA directly on your ledger signer. And finally and and that's uh

that's one that's relatively new and and it's probably the one we want the most uh um you know experimentation with at this point is the key ring CLI. Uh and essentially it allows us to um um to to go beyond crypto uh as a as a developer you can um provision your your machine with your ledger hardware and um allow your agents to encrypt and decrypt secrets secrets like API keys or or or other um um secrets it needs to access to um um perform actions for you. Um so that's quite convenient. It allows you to go from having a secrets in clear in a N file to something more secure and

Keyring CLI for Agent Secrets

encrypted directly via ledger. It's also recoverable via ledger. So if you lose your ledger, you can access again those those um those secrets which are uh stored on a decentralized um protocol that's called the the ledger trust chain. Um so on on on this one uh essentially um you know any any form of hacks or experimentation to extend the limits of this feature or make it available on on more uh setups for example remote agent setups will be uh will be quite interesting for us. Um that's one of the things that that we have released. I'm going to demo it in a second but there's two other apps that are beyond cry crypto. They're called

OpenPGP and FIDO2 Applications

open PGP. So that allows you to essentially use your ledger as a as a um an encrypting machine and a smart card. And there's the Fed2 device app I just discussed which is a security key. So I think there's a lot of promising things to uh to to do with those different primitives if you have an agentic workflow that needs to access certain websites or secrets or API keys. Um all right. So that's for the general presentation and I'm going to walk you through the um the video. Let me just refresh this one.

Okay, cool. So here's the video. Oops. Let me press play. All right. We um we did it in 2x speed because with a with the AI um taking some time sometimes to answer it's easier. So here I'm I'm asking my code to essentially check uh my my balances with the ledger wallet CLI and also determine if there's any yield opportunities for me. Um so it's it's doing that now. At this point I have my Ledger device plugged in. I have the Solana and Ethereum apps uh available so it can check those balances.

Agent Portfolio and Yield Demo

It found 15 USDC on my uh first account and uh a few yield opportunities. So um you know what's interesting here is that it gives a few recommendations. I don't have a lot of test funds. So um you know essentially it's recommendation is not necessarily to stake everything, but I I'm still going to go ahead and st uh directly through the CLI. um I chose um to go with their recommendation.

And so here essentially what I what I'm doing is is confirming on the device. There's two device screens. One to approve the um the authorization to to deposit and then the actual deposit flow. And those two transactions on my device come with both clear signing so I can read exactly what I'm approving and they come with transaction check which is a simulation service. we have in the in the back end that checks that there's no fraudulent smart contracts involved and that um you know the what I can expect from this operation is actually going to happen and so here I validate both on my device the approve and deposit are are confirmed and checked on the blockchain by the by the AI. Um so that shows you

Clear Signing and Transaction Checks

just one example of what you can do with the CLI and now the second part which is the um encryption part. So I ask it, okay, now I want you to encrypt my anthropic API key. Um, and so that's using the ledger key ring on the CLI. Um, it tells me that there's um no key ring yet on this machine. How can I provide this uh this API key? And here there's actually quite a few ways to do it. uh the AI will already recommend you to use your clipboard so that it never sees the um the API key itself. Um but there's other ways to do it. Uh actually

Encrypting an Anthropic API Key

um uh as you'll see. So here it provisioned my CLI. I don't have to get really into the technicalities as a user. I just asked it to uh to uh encrypt my API key. uh it tells me um to copy it on my clipboard and actually in this instance I have it in a in a file in clear so I just tell it it's in this file um and it goes ahead and encrypts it thanks to the decryption key uh and encryption keys it has access to uh it deletes the original file and from now on I don't really need my

ledger device. My agent can um you know decrypt and encrypt um access tokens as as it sees. Um password is also protected in the matching key chain here. So that's an extra layer of of security. Uh and I just asked it for the purpose of the demo to show that it hasn't compromised that entropic API key or or consumed it in any shape or form. Um so um here it goes thinking before it gives an answer.

decrypts the secret and um if all goes well, it shows that essentially the um um the agent is able to decrypt decrypt this securely. Okay. Boom. So it it did get the 200 status from Enthropic. So it was able to uh authenticate and use that API key and uh and temporarily use that secret without ever um you know reading it or or consuming it or leaking it. Uh so I ask it to prove it again just by running um this this command above and it does

uh confirm that indeed it's not in in the history or or the um or the memory of the agent. So uh essentially it was able to use that um encrypted secret securely by uh decryptting on the trust chain and um and not um consuming it's its plain text version. That's it for the demo. It's it's quite uh straightforward here because I'm I'm proactively uh um talking to my cloud code agent uh for for the purpose of the demo. But you know when it gets really interesting is when your agent does autonomous work for you. So you can imagine open claw or or grockbot or airmes they will need to access those

Why Secure Secrets Matter for Agents

secrets on a on a on a more regular basis and uh and accessing and using the secrets on a on a in a secure way is is ever more relevant today. All right. >> So yeah and uh this brings us to the tracks for for this hackathon. So as you know there's two tracks. So we have one called AI agents X ledger. So it's about starting something new during the hackathon. Pretty straightforward. And we have a continuity track which is basically extending a project you have already but finding use cases for the agent stack and the tooling Oscar just showed you. Um so here are a few examples. We do have a page as well

Ledger Hackathon Tracks

which is linked at the end of this deck. Uh on the developer portal at ledger the documentation for developers. you have a brand new page with all of this inside. Um, essentially uh the key message here is that you want to bring use cases where you know agents don't store passwords directly because we saw that agents can get compromised and you don't want a compromised agent giving out all your passwords for every service you ever use. So the idea is like what can you build during this hackathon where you give the agent permission to use uh your keys without giving it your keys directly. Um so this one is highlighted here. Uh on the right top right we have um you know obviously key ring uh sorry

Giving Agents Access Without Keys

obviously ledger devices need to be plugged into your to your machine in order to work. Um so the idea is to implement key ring basically in a machine where you can't. So this can be a VPS um you know a CI runner anything hosted uh that doesn't have direct access to your device. This is also very interesting. Um we have the more traditional use cases on the bottom. Um you know agents that pay for APIs tools. So you may be familiar with X42 for example. Um so the idea here is that how can you you know how can you add ledger in the flows for autonomous payments or payments under certain conditions. This is also very useful and and interesting.

Remote Agents and Hosted Machines

And the last one which is more of a global one is uh it kind of summarizes the whole idea here is that you know the core message is human in the loop like you want the agentic world to continue doing it thing but you want the human in the loop for approving high-risk actions moving funds. So there's many ideas here too. You can imagine some thresholds you know having a platform where after a certain threshold or amount you know you get in the loop and as a human you validate certain actions. It's voluntarily um global at this slide. We don't want to get too much into detail because you know giving creativity its own place, but there's a lot that can be done with a ledger device. Always keeping the human in the loop when it

Keeping Humans in the Loop

matters most. Um so for this track here, we have um uh $2,000 for the first place and uh and five no one $1,000 for the second place and 500 for the third place. So three winners here. Uh and this brings us to the second track which is continuity. Um we have two prices here 1,500. Um so this is more like you know continuing what you what you've built. Uh for example you may have a product and you want to add ledger to it. Uh also very interesting but there's device management skill device management kit skills that can allow you to very easily connect Ledger devices to your existing apps. uh we've made things simple for

Continuity Track and Integrations

you to really integrate Ledger easily. So you know if you look at hackathons a year or two years three years back it was more of a challenge for developers. Nowadays it's so simple not only because of AI but because of the things we allow you to do with AI and the libraries we put into your hands like like Oscar showed you for the wallet uh for the key ring and and so forth. Um so you know make wallet CLI ring the key back end for the environment. We we talked about this you know having not having the passwords and all your credentials in the end files but protecting them. Um we also have things uh you know device confirmation uh when it matters of in typical flows of your product. And finally, feel free to look at the repos we have. We have many public repos. You

know, you can publish a PR on any pretty much anything we do that you think would be useful. And this also is part of this. It's continuity for us uh for for the ledger packages, but it doesn't have to be only Europe. You can you can of course participate in the open source initiatives we we do. Um so what we like in general this is more uh general but um obviously the the boundary between what is autonomous and what needs your approval has to be clear because we're talking about agentic with human in the loop flows um you know real ledger integrations and that that makes sense essentially um and we do need to be able to try it. We will try it. We will render code. Uh and if you can also explain when you pitch you know what the

Judging Criteria and Documentation

before and after like what Ledger did in your product. How did Ledger make your product better? Uh make it easy for us to understand the added value of Ledger here. Um we do request uh if you can to submit a documentation feedback too because we have a the developer portal as I mentioned the developer for documentation for developers that we continuously improve and your feedback is so useful for improving this. So if you can share a bit of experience, doesn't have to be very long, a simple page would do, but you know, how did you find using the tools Oscar just presented? Are there any gaps? Did you struggle with this or that? Um, basically anything. Feel free to do pull requests as I mentioned before. But yeah, if you can include the documentation feedback or some feedback,

it would be nice for us to improve for the for the future hackers. Um, and yeah, I did mention a QR code. So the all the info we presented here uh is on the page here developers.ledger.com/eonline. The QR code will take you there. It has the tracks, all the prizes and quick links to the right sections of the documentation. So very practical. You have all the commands that you need. Pretty much everything to get started here. Thank you very much. Amazing. Thank you for this very very nice workshop. There are a few questions in the chat. Sure.

Fraudulent Contract Check Q&A

>> Can read them out for you if it makes it easier. How does fraudulent smart contract check work from Alex? >> Yes. Uh great question. So I think you're referring to um transaction check. Uh it's a it's a service we launched um in in May uh of last year. Uh and essentially what it does is it uses a a few thirdparty providers including blockade and cyers to simulate um the transaction. There's a bunch of other things that happen in the background like checking if if the if certain addresses are are somehow linked to fraudulent addresses.

Um but it's actually the the one of the core um feature that the those providers offer is is a scanning the blockchain and checking for any potential fraudulent behavior. There's a there's a bunch of rules that they put in their own algorithms. But what we do on the ledger side is is quite unique because we offer first of all multiple provider simulations in parallel which is I think unique in this industry. Usually you would rely on on one provider. So if any of the provider fails um you know the other one can uh can can um can show the um and flag a thread uh for the other uh and the second thing which is um important is that those simulation results are not shown on the software

side but on the hardware side. So um you know it makes it uh much more secure and cannot be tempered with uh if you imagine very sophisticated attack scenarios. Um you know sometimes the front ends are are hacked by those same hackers to say that the transaction itself. Well in this instance it goes directly to the ledger device um your um you know your surfer because if there's actually a threat it will show there and not on your smartphone or your computer. And it's uh yeah just to add to that it's also um an optional feature um and uh it's very nice because you can also see the reasons why something has been flagged as malicious and you can choose you know do I want to continue despite

the risk or do I want to reject you know so we give control to the user and you always in control of whether you sign or not it's just an added information of like okay wow I'm I'm about to interact with something that was flagged as malicious >> y all optional and and it's only for comfort of the users. Yeah, one final thing on this one. It's um only available on our latest devices, so touchcreen devices like the Ledger Stacks, Ledger Flex, the Ledger Nano Gen 5, not on Nanos if you're using a nano, but you can also simulate this through different toolings, playgrounds, um software simulators.

Okay, awesome. Yes. >> Next question. Uh was that API key retrieval demo based on Mari from can this year? Um I'm not familiar with Macki from CAN. Are you a >> No, I'm not. I'm not so familiar with this. >> Um no, but I look it up. >> Yeah, it might have been like a hackathon project for the CA hackathon. Okay. Um Anorak is asking where is the where's the right place for Ledger keyring protocol questions and bug reports, GitHub issues, leedger live, discord or security contact. I have two reproducible findings in the permission handlings.

API Key and Bug Report Questions

>> Okay. Um yeah so actually in the page that you see here in the background with the QR code there is a a group chat at the bottom. Uh I think this is I mean of course direct direct message is also possible but this is kind of like the the the the place to to talk to the whole team that will that will help you guys. So yeah I think starting from here would be would be very nice actually. But thank you. >> Cool. >> I think ROM reactor might have a question. >> Uh yes. Can you guys hear me by by the way?

Nano X and Keyring Security Q&A

>> Yes. Yeah. >> Cool. Cool. Um, yes. So, I just have like one simple question and uh kind of a followup just u get a more like understanding of the project I want. But the simple question is would the Ledger Nano X be capable to initialize the ring CLI and the the encryptions and decryptions? >> Okay. So, that's good. Um and then the follow-up question is I also during this hackathon this was one of the ideas we were trying to build. Obviously you know like having agents access to your uh keys is is a serious security issue and I just wanted to get like a more understanding of how the ring CLI is able to encrypt and decrypt because at the end of the day it kind of looked

like at the presentation you showed me that clot still kind of had access to the raw text of the within its context file to initiate initiate or is that wrong? Is it does it never does the API never go to the context of the uh the cloud while it's generating or reasoning or whatever? >> So um so here um I'd say both the um ring CLI and open PGP device apps are two primitives to encrypt and decrypt secrets. They do work differently. Um, I'm I'm talking about Open PGP because it's um the device app you can find in the developer settings that allows you to ensure that you know uh everything is only decrypted or encrypted if you have

your ledger plugged in and and sometimes if you uh approve on your device and all that can be configured through the app. Um and that's and that's quite useful for certain types of secrets but the um the ring CLI in itself works very differently. It works on the um um the keying protocol that we also use at ledger to essentially encrypt um um ledger account information on on ledger wallet. Uh and that doesn't happen with a device plugged in and and and formal validations on the device. It happens um you know through um um through um the trust chain with a with a simple web connection. Um so what actually happens

Trust Chain Authorization Model

is that you use your device to provision a certain machine with the rights to encrypt decrypt those um um those secrets whatever they are. And so your ledger hardware serves as the root for that um for that authorization. But then once you're initialized um you know the agent in effect uh can can decrypt or encrypt autonomously and it's more fitted for an agentic workflow and uh and things that are um that you want to protect but are relatively uh uh uh I mean they're less sensible than transactions like accessing API keys to to do a request with cloud or something like that. Um the one thing I'll add is that on top of that there's like a

number of um additional layers of security we've added. And so for your agent to access that um and to essentially decrypt a secret, there's also like a a password that's tied to your machine's um OS. Um so um you know there's a there's a number of things there, but I'll let you also test on your own. So in in summary, so the like basically the agent contacts uh a computer server somewhere. That computer has the uh CLI ring built in into it connecting with the trust chain. So the the agent is simply just asking the machine like hey um here I have the approval from the user to do something.

Um, here's like the signature I received from the le ledger or it could be like a world ID selfie check whatever that machine then does the ledger encryption decryption does whatever the agent requested sends in like a response like okay here we sent on the user with you know with the user's approval we sent on his behalf by USDC to stake or whatever and the agent just only receives that response and kind of gets back to the user saying like hey I did what you asked me to do obviously I never seen your didn't see any of your secrets because I I was just interacting with machine that has all that encrypted right in some way. That's kind of >> Yeah, >> correct. Yeah, that is also what was here, I think. And

>> yeah, on the on the top left. Yeah, definitely. and and um I I guess um you know one other point is that um that that server so the trust chain is actually um decentralized and uh and uh and uh because your secrets are are encrypted via your ledger on your machine they're not um you know accessible through that um trust chain directly uh you're let's say you're a bit more like self-custodial on your secrets in that way it's all linked to your ledger hardware it's accessible through the machines that you uh you're self-provisioning with your edger hardware but it's not itself accessible um outside of that.

>> Awesome. Cool. Thank you guys. >> Yep. >> So very useful. >> Happy hacking. >> Yeah, happy hacking. And I see there was one last question on the fraudulent smart contract. Uh it's only for ledger users. Yes. Um uh because the the simulation is on the hardware itself or the results are on the hardware itself should I say. Uh, and uh, as I said, it's only for the latest touchscreen devices.