Phantomwallet Ledger accounts and offline signing

USB and Bluetooth compatibility

Desktop USB support and mobile Bluetooth support apply to different device lists, so choose the interface your particular Ledger supports. Nano S Plus appears in the extension's USB support list, while Nano X appears in the mobile Bluetooth list. Stax and Flex support both documented connection paths. A device's compatibility with Ledger's own software doesn't automatically establish its compatibility with Phantom.

Chrome receives full support for the extension; iOS and Android receive full mobile support. Compatible Chromium alternatives don't receive the same level of support. USB requires a cable carrying data, so a device can charge without becoming visible to the browser. Bluetooth requires both an eligible device and permission for Phantom to access the phone's Bluetooth connection. Wireless connectivity changes the transport between devices, while signing remains on the Ledger.

Hardware accounts alongside other wallet accounts

Adding a Ledger account gives Phantom access to its public addresses and hardware signing without converting your existing software accounts. The device protects the keys controlling its own addresses. Assets already held at a different address remain under that address's existing keys. Moving those assets to a Ledger-controlled address requires a blockchain transfer, with the receiving network and address matching the asset you send.

Connected hardware accounts support asset viewing and transaction signing through Phantom, including supported token transfers, swaps, and app interactions. Select the account intended for the action before reviewing a request. A balance shown elsewhere in the wallet doesn't establish which account will sign. An account added only for watching an address can display holdings without providing transaction-signing access.

Account names help distinguish addresses, and those names remain private within Phantom. The selected address determines which holdings and signing credentials an action uses.

Chain apps and address discovery

Ledger network apps and account derivation determine which addresses Phantom can access; matching the wallet brand alone doesn't identify the account.

Apps for supported networks

The Solana and Bitcoin apps handle their respective networks, while the Ethereum app covers compatible EVM networks. EVM means Ethereum Virtual Machine. Phantom's Ledger connection also needs support for the selected network in the wallet interface. Installing a Ledger app doesn't add an unsupported chain to Phantom, and opening an unrelated app won't provide the required signing capability.

Addresses derived from the device

A derivation path specifies how a wallet derives account keys from its recovery seed. An account index distinguishes accounts within that scheme. Different supported paths can produce different addresses from the same Ledger.

Path and account index

Phantom supports several Ledger derivation groupings, including common Ledger Live paths. Ethereum, Base, and Polygon addresses can share an index across the supported grouping. An account's position or label in another interface doesn't establish an address match.

Previous account activity

Ledger Live paths and some legacy derivation paths appear during account discovery only when previous activity or funds exist. A missing address can therefore reflect the discovery rules. An empty address on another path doesn't prove the expected account has lost its assets.

What does Ledger approval actually confirm?

Ledger approval authorizes the device to sign the presented request; it doesn't establish that a blockchain transaction has completed. Phantom prepares the transaction and requests the device's confirmation before submitting it to the network. The transaction still needs network acceptance and confirmation. A transfer completes when the network confirms it and the recipient receives the assets.

Ledger signs transactions inside the device without exporting its private keys to Phantom. The computer or phone handles the transaction interface and network communication. That separation protects signing credentials from exposure through the connected wallet interface. It doesn't make the destination or requested operation trustworthy. Transfers, swaps, and staking requests need review of their own instructions, including the affected account and the action you authorize.

Blind signing and readable approvals

Blind signing applies when the device can't show the full transaction details in a form you can meaningfully inspect. Some supported transactions require this setting in the relevant Ledger app. It concerns transaction visibility, not whether the private key stays on the device.

Readable signing presents transaction information on the hardware screen for review. The available detail depends on the request and its signing support. Don't assume a familiar app interface guarantees readable details for every operation, or treat a confirmation prompt as proof the request matches your intent.

Review the recipient, asset, and amount where the request exposes them. For a contract interaction, consider the permission or action the signature grants. A malicious request can move funds or authorize token spending even though the hardware wallet protects the signing key throughout the approval.

Enable blind signing only for the Ledger app involved when the intended transaction requires it. If you can't establish what the request authorizes, decline it. Changing this setting to resolve a signing error doesn't establish that the underlying transaction deserves approval.

Connection failures and missing approval prompts

A missing Ledger device usually points to a connection problem, while a connected device without an approval prompt points to the signing setup. On desktop, competing access from Ledger's desktop application can block the browser connection. A locked device or charge-only USB cable can also prevent detection. Closing the desktop application, checking the cable, and updating device firmware address those prerequisites without changing the account's keys.

Mobile detection requires Bluetooth on both devices and Bluetooth permission for Phantom. During initial pairing, the Ledger should remain unlocked on its home screen until Phantom asks for a network app. During transaction signing, the correct network app needs to be open. Those are different stages, so leaving the device in the wrong state can prevent progress despite a working Bluetooth connection.

An outdated network app or a required blind-signing setting can explain a transaction request that doesn't reach approval. Before enabling blind signing, make sure you understand what the request authorizes despite the details the device can't display. If a previously paired mobile device remains stuck, forgetting it in the phone's Bluetooth settings allows a fresh hardware connection.

Backup boundaries and restored access

Restoring Phantom with its main recovery method doesn't automatically restore Ledger accounts previously added through a separate hardware connection. Those accounts depend on the Ledger's credentials. Phantom also doesn't expose a connected Ledger account's recovery phrase or private keys through its credential-export controls.

A Ledger recovery phrase restores the device's keys during recovery or replacement. For passphrase-protected accounts, you also need the original passphrase. Keep that backup separate from credentials for other accounts. Hardware connection uses the device, not a phrase typed into Phantom. If the phrase enters a software environment, someone obtaining it and any required passphrase can recreate the keys independently of the Ledger and bypass the protection its physical approval normally provides.

Public addresses and continuing app permissions

Connecting a Ledger-backed account to an app exposes a public address the app can associate with blockchain activity. Offline key storage doesn't make the address or its transactions private. Phantom lets apps request signatures and transactions after connection, so account selection also determines which public identity the app sees. A connection alone doesn't give the app the Ledger's recovery phrase.

Token spending approvals can grant a contract continuing authority over specified assets. Disconnecting an app from Phantom doesn't revoke those blockchain permissions, and unplugging the Ledger doesn't cancel an allowance already granted. Removing an unwanted allowance requires the appropriate revocation action on its network. Decide whether the requested permission fits the assets and account you intend to use, especially when it can remain effective after the connection ends.

View full-size image