Ledger Atom: why Ledger is building an Android device

Ledger has spent years explaining why private keys should be kept separate from your smartphone. Now it is proposing an Android device that will run everyday apps alongside a hardware wallet: Ledger Atom was unveiled on October 15, 2026, at the Op3n conference in Paris. Atom looks like a phone, with a separate hardware environment protecting key storage and transaction approvals. We reviewed Ledger’s whitepaper and the Atom product page to explain how the system works, why Ledger is building it, and who might want to wait for its release.

What is Ledger Atom? Specifications and expected release

Ledger calls Atom a signer: a device used to sign transactions and other operations. It connects to 4G and 5G networks for data only and does not support cellular voice calls, SMS, or emergency calls, including calls to 112, even with an active eSIM. There is no physical SIM card slot either. Voice and video calls are available only through third-party apps over the internet.

Android running on a Qualcomm processor handles everyday tasks. Ledger uses a hardened build based on the Android Open Source Project (AOSP). Keys and signing are handled by Ledger OS on a separate ST54M Secure Element chip, certified to Common Criteria EAL6+. That certification applies to the chip; Ledger plans a separate CSPN evaluation of Atom as a complete device.

Ledger lists the following specifications:

• Body: 250 g, 78 × 164 × 9 mm.
• Display: approximately 6.8-inch AMOLED with a 60 Hz refresh rate.
• Rear camera: 50 MP.
• Battery: 4,000 mAh.
• Connectivity: 4G/5G via eSIM, Wi-Fi, Bluetooth, NFC, and USB-C.
• Unlocking: fingerprint sensor for Standard Mode.
• Spare parts: Ledger says parts will be available for seven years after the last device is sold.
• Privacy Switch: a physical switch that cuts power to the cameras and microphone at the circuit level.

Ledger has opened Founders Edition reservations with a deposit that, under the company’s terms, is refundable if you cancel before shipping. The company plans to start shipping Atom in summer 2027, although that timeline may change. Before shipping, Ledger must complete the required procedures: equipment authorization under FCC rules in the US and conformity assessment for CE marking in the EU. Reservations are available on Ledger’s official website; before reserving, check shipping to Ukraine, the device’s regional version, and compatibility with your carrier’s eSIM service.

How Secure Mode works

Because Ledger Atom connects to the internet and runs third-party apps, its secure environment needs to withstand attacks on Android. Ledger separates the two environments at the hardware level while retaining the principle behind its existing wallets: keys and transaction approvals remain under Ledger OS control. The whitepaper describes an architecture designed around the assumption that an attacker has complete control of Android.

Two independent environments in one device

The everyday environment, Standard Mode, runs on the Qualcomm chip and handles apps, the camera, network connections, and power management. Secure Mode relies on three separate components: the ST54M Secure Element running Ledger OS; an STM32U5 microcontroller that renders graphics under Ledger OS control; and an FPGA, a programmable chip that switches control of the display and touch panel between the two environments.

The seed (the secret value from which wallet keys are derived), private keys, and Ledger OS PIN are stored in its Secure Element. According to Ledger, the Qualcomm processor has no hardware access to them. Each environment has its own unlock method: Android uses a pattern, password, or fingerprint, while Secure Mode uses a separate Ledger OS PIN that Android cannot access. Another Secure Element protects Android credentials and storage, so Atom contains two secure chips with different responsibilities.

The environments exchange data through a dedicated physical interface over a secure channel. Android can send requests to Ledger OS, such as a request to sign a transaction, but it cannot observe activity inside Secure Mode, alter what its screen displays, or approve operations on the user’s behalf.

How the FPGA and Secure Bar protect approvals

On an ordinary smartphone, the main processor and software control both the display and touch input. An attacker who compromises the system could show one recipient address while submitting a transaction with another address for signing. A hardware wallet provides its own screen for verification, beyond the control of the connected computer or phone. On Ledger devices, that screen is controlled by Ledger OS running on the Secure Element. Our article on Clear Signing and Blind Signing explains what a wallet can show before signing and how to check what a request authorizes.

In Atom, the FPGA sits between the Qualcomm processor and the display. In Standard Mode, it routes Android’s image to the screen and touch panel signals to Qualcomm. When a compatible app requests approval for a transaction or an AI agent’s permissions, Ledger OS switches the FPGA, physically disconnecting Android from the display and touch panel. The microcontroller then renders the image under Ledger OS control, and touch signals go only to the secure environment; the cameras, microphone, and other sensors are automatically switched off. According to Ledger, even an attacker with full control of Android and root access would be unable to see the secure screen’s contents, intercept the PIN, or simulate taps.

A malicious app could still show a fake approval screen while the device remains in Standard Mode. To help users distinguish between the modes, Ledger has designed the Secure Bar: a strip at the top of the screen controlled exclusively by Ledger OS through the FPGA. Android cannot draw in this area, so the bar would continue to show the device’s actual mode even alongside a fake approval screen.

Protection against physical tampering

The Ledger OS Secure Element, microcontroller, and FPGA sit in a separate protected area of the circuit board with active tamper detection. The traces carrying the display signal from Qualcomm to the FPGA run through the board’s internal layers and surface only inside this area, making it harder to tap them without detection. A second protection circuit responds to the case being opened, including for repairs; resetting this protection after it has been triggered requires Ledger’s supervision. The company also says the device can detect display removal.

Although Ledger Atom is designed to work independently, you will need a second device for Genuine Check. Secure Mode will display a dynamic attestation code that must be verified through a dedicated Ledger app on another nearby device. According to the manufacturer, this check is intended to verify the authenticity of the main secure chips and their firmware.

Why Ledger is building an Android device

Ledger expects Atom to be used for managing crypto, approving AI agent actions, and signing in to third-party services. In each case, it allows you to run an app and approve its requests on the same device.

Apps and hardware signing on one device

Nano Gen5, Flex, and Stax need a computer or phone, where an app prepares a transaction and sends a signing request to the wallet. Ledger OS does not rely on the accuracy of what that host device displays: you check the transaction details on the wallet’s own screen before approving the signature. This keeps the keys isolated, but requires two devices and a connection between them.

Ledger Wallet will run on Ledger Atom itself, allowing you to buy and swap crypto, use staking services, and view transaction data. When an app sends a request that requires secure approval, the device will switch to Secure Mode so you can review the details and approve the operation. If you use decentralized finance (DeFi) services from your phone every day, you will not need to connect a separate wallet to approve these operations. In its whitepaper, Ledger describes this as a change in form factor while retaining the security model.

Controlling AI agent actions

Ledger is also developing hardware-backed approvals for AI agents that can monitor markets, prepare payments, and propose trades on your behalf. If an ordinary app displays an approval request, malware could alter its contents. On Atom, Ledger Agent Intent is intended to route these requests to Secure Mode, where you would review proposed operations or agent permissions and approve them by tapping the secure screen. Whether each operation needs separate approval depends on the rules you set.

Ledger plans to have OpenClaw integration ready when Atom launches. OpenClaw is a platform for running your own AI agents, and we cover its setup in our OpenClaw guide. You do not need to wait for Atom to use Agent Intent: the service is already available for Nano Gen5, Flex, and Stax. Ledger Agent Stack, an open toolkit for developers, has been available since July 2026.

A platform for third-party services

Atom expands Ledger’s platform: third-party services will be able to use the secure screen and the device’s cryptographic functions in their own apps, adding hardware-backed approvals where an operation requires them.

Solana Mobile has chosen Ledger as its first hardware partner. Every Atom is expected to come with the Seeker app, providing access to the Solana dApp Store, which had more than 1,500 apps at the time of the announcement. Signing and approvals in Seeker are intended to use Secure Mode. Kraken is still exploring a similar integration for its exchange customers. For other developers, Ledger is preparing the Atom SDK, a toolkit for adding hardware-backed approvals to Android apps.

Among the announced features beyond crypto is encrypted messaging, which Ledger plans to add later. Messages are intended to be encrypted and decrypted inside the Secure Element, with third-party messengers carrying only encrypted data; another Atom owner would read them in Secure Mode. Other announced capabilities include secure storage of passkeys and multi-factor authentication. Proof of You is intended to provide cryptographic confirmation that a person approved a specific action on a genuine Ledger device.

Security limitations and open questions

Connecting to the internet increases the attack surface by exposing more components and potential ways to attack the device. Ledger acknowledges this and describes what an attacker with control of Android could do: read data available in Standard Mode, modify requests to Ledger OS, mislead the user before the switch to Secure Mode, and propose transactions of the attacker’s choosing.

The app running in Ledger OS must independently parse the request and display the transaction details on the secure screen, but the user still needs to check those details before signing. Isolating the keys will not stop you from approving a dangerous operation if you do not examine what it authorizes. Our article on checking MetaMask transactions and the limits of simulation explains how to review requests and token spending permissions.

Before Ledger Atom launches, questions also remain about support, practical value, and security testing:

• Audience and the Solana Mobile partnership. Solana Mobile already has its own Seeker device with Seed Vault, a protected key store. How the two devices’ use cases differ should become clearer after Atom launches.
• Cost and convenience. An alternative to Atom is a dedicated Android phone for crypto apps paired with a hardware wallet. Before buying, compare the convenience and total cost of both options. Our Ledger model comparison covers the differences between the standalone wallets.
• Android updates. Before buying, check the final commitments for OS updates and security patches, including when each support period starts. The stated seven years of spare parts availability does not establish the length of software support.
• Post-quantum cryptography. The “quantum ready” label refers to the ST54M chip’s readiness for post-quantum algorithms designed to resist attacks by quantum computers, and its compatibility with new standards from NIST, the US National Institute of Standards and Technology. Ledger has not specified when these algorithms will be used in Atom or which operations they will protect.
• Independent testing of the complete device. Ledger plans an Atom evaluation under the CSPN program of ANSSI, France’s national cybersecurity agency, and publication of external audit results shortly after launch. Until those materials are available, assessments of the overall system’s security depend on the manufacturer’s description. EAL6+ certification applies to the chip, not the entire Atom architecture.

Who should wait for Ledger Atom?

Ledger Atom may be worth considering if you:

• already use a separate phone for crypto apps and want to combine them with hardware signing on one device;
• actively use the Solana ecosystem and access decentralized apps from your phone;
• plan to delegate financial operations to AI agents and use Ledger to approve actions that require your permission;
• frequently use DeFi and find it inconvenient to keep connecting a separate wallet to your phone over Bluetooth.

Buying Atom is less likely to make sense if you:

• want to replace your main phone, since Atom does not support cellular voice calls, SMS, or emergency calls;
• hold crypto for the long term and make only a few transactions a year: a separate hardware wallet without its own internet connection is sufficient for that.

For holdings you could not afford to lose, consider a multisig setup with keys held on several devices from different manufacturers. This distributes control over transactions; simply replacing one wallet with Atom does not provide that distribution.

If Atom interests you, read the deposit refund and final payment terms before reserving. In some countries, Ledger calculates the local currency amount from its euro price, so the amount due may change before you pay the balance. Independent audits and tests of production devices will help assess Atom’s practical advantages once they become available. If you need a hardware wallet with a touchscreen now, Ledger Flex and Ledger Stax run Ledger OS and work with your existing phone.

Conclusion

Ledger Atom brings Android apps and a hardware wallet into one device. During approval, Ledger OS is intended to take full control of the display and touch panel, while the Secure Bar shows the active mode. For daily use of DeFi and AI agents, this could be more convenient than repeatedly connecting a separate wallet. Before buying Atom, wait for production devices to be tested and compare their capabilities with what you need; for long-term crypto storage with occasional transfers, a separate hardware wallet remains sufficient.