Ledger sells the Atom at $849 through its own shop only: “For years, our customers have been asking us for a Ledger phone”

At its own Op3n conference in Paris on October 15, 2026, Ledger presented a device that looks like a smartphone and does not want to be one: the Atom. The Founder's Edition costs $849, reserved with a refundable $100 deposit, with the regular price set to be $899 later. Shipping is due in 2027 at the earliest. The most important line of the announcement for you, though, is not in the spec sheet: Ledger sells the Atom exclusively through its own shop. The intermediate trade, through which you buy a Ledger device in an electronics store today, falls away for this product.

That is not a marketing decision. Since October 9, Ledger has been investigating tampered devices sold through a reseller in South-East Asia, and in Germany MediaMarkt and Saturn have halted sales of Ledger devices as a result. The distribution route has thereby become a security matter in its own right. This text sets out what Ledger has announced, what of it is substantiated, and what it means for a device already sitting in your drawer.

Ledger Atom: $849 for the Founder's Edition, shipping not before 2027

Ledger calls the Atom a signer. A signer is a device whose only security-relevant job is to sign a transaction without the private key ever leaving it. The term deliberately sets the Atom apart from the words hardware wallet, because the device is at the same time a fully functional Android phone.

The headline specifications from the presentation: a 6.77-inch OLED display, a rear camera, a 4,000 milliamp-hour battery, a Qualcomm processor from the Dragonwing line and an eSIM that carries data only. Calls and text messages are not part of the feature set. A mechanical switch physically cuts the camera and microphone off from the power supply.

On the delivery date the statements diverge. The second quarter of 2027 and the summer of 2027 are both cited, each subject to approvals still outstanding. Ledger has published no binding commitment. For you that means this: reserve today and you are putting $100 aside for a device whose delivery is more than a year away and not scheduled.

What the deposit is, legally

The $100 is refundable on Ledger's own account. A reservation is not a purchase: there is no product, no delivery date and therefore no warranty either. Reserve, and you are giving the manufacturer an interest-free loan for an indefinite period. That is common with pre-orders in consumer electronics and still a decision worth taking deliberately.

Secure element and Android side by side: how the signer separates the keys

Technically, two worlds run in parallel inside the Atom. On one side an Android system built on the Android Open Source Project, running perfectly ordinary apps. On the other side Ledger OS, the company's own operating system, running on a secure element. A secure element is a separate chip hardened against physical attack, which stores keys and computes signatures without surrendering the secret. Ledger states a security level of EAL6+ for the chip fitted.

As soon as a security-relevant action comes up, the device switches into secure mode. In that mode the secure processor takes control of the display, so that no tampered interface can show you a different recipient address from the one actually being signed. A dedicated FPGA component, a freely programmable logic chip, keeps the everyday apps out while that happens.

This is the clean answer to an old problem: move crypto-assets through an ordinary smartphone and you are trusting that none of the installed apps is reading along. With the Atom, that leap of faith is meant to disappear. Whether the separation holds cannot be judged today. No independent audit of the architecture exists, and Ledger has published no threat model against which the claim could be tested.

The active shield is meant to report the case being opened

The part of the announcement that matters most for the current situation is an active shield. What is meant is a sensor layer with its own power supply, intended to detect anyone opening the case, drilling into the board or applying probe tips. If it registers an intervention, it reports this to the secure element. Seals on the packaging and on the device itself come on top.

This shield aims squarely at the type of attack that has occupied Ledger since October 9. The company has given no technical data on it, and an independent assessment is outstanding. The objection heard among specialists is that a protection claim without a published threat model cannot be verified. That is a fair point and remains open for now.

Sales only through the company's own shop: the middleman drops out of the supply chain

According to several trade publications, the Atom will be sold exclusively through Ledger's website, not through authorised resellers. One source qualifies this with the word "initially", so whether the rule holds permanently is open. The thinking behind it is easy to follow: the shorter the route from the factory to you, the fewer stations at which someone can open a parcel.

For the German market that is a real change. Hardware wallets have been part of the range at large electronics chains here for years, and many buyers value exactly that: picking a device up in a shop without leaving a delivery address at which crypto-assets might later be suspected. That advantage falls away with the Atom. To weigh it up, our hardware wallet comparison sets out the devices still available through retail, along with their purchase routes.

The CryptoBilis case: a foreign component captured the recovery phrase during setup

The occasion for the whole debate came from Ledger's own security laboratory, Donjon. In a device that had been sold through the South-East Asian reseller CryptoBilis, it found a built-in foreign component. That component captured the recovery phrase while the buyer was setting up the device for the first time, and transmitted it out over the mobile network. The recovery phrase is the sequence of words from which all of a wallet's keys can be restored; whoever holds it holds the balance.

What matters for placing the case is where the attack came in. On Ledger's account, the security chips and the operating system were left untouched. The attackers did not break the cryptography; they bought genuine devices, inserted components of their own and put the altered units back into distribution. Ledger speaks of months of preparation and an outlay running into the millions. Examinations of shop devices and warehouse samples produced no further finds.

Several figures are circulating for the scale of the losses. $86 million, around $90 million and $93 million are all cited. None of them is confirmed, and the reports draw partly on the same trail. One individual case is substantiated, traced by Chainalysis: the operator of a fraudulent job offer moved more than 60 bitcoin, worth about $4.8 million at the time, to three Ledger addresses on September 22 and cleared them out entirely on October 9 to a destination address that investigators attribute to the stolen funds. We have written up the details of the find in our report on the confirmed implant.

Sales halted in six South-East Asian countries and Hong Kong

After the find, Ledger asked its distribution partners in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to withdraw the devices from sale. In parallel, new requirements apply to authorised resellers worldwide: returned devices may not be sold again, however untouched the packaging looks. Devices are no longer to lie openly on the shelf. Unusual customer reports go straight to Ledger.

These three requirements are the practically most important part of the whole story, because they affect German retail too. The returns rule closes the gap through which a prepared device can re-enter sale as a return. Keeping devices out of open display takes away the opportunity for attackers to handle them in the shop itself.

How competitors have reacted

Trezor, the second large provider in this market, said it had found no indication of tampered devices of its own, and is nonetheless ending partnerships with resellers. Two manufacturers are therefore drawing the same conclusion independently of each other: the intermediate trade is the weak point hardest to control.

MediaMarkt and Saturn in Germany: what now applies when buying in store

MediaMarkt and Saturn have halted sales of Ledger devices. In concrete terms: that purchase route is not available. Whether and when it returns depends on how the investigation ends and how the new reseller requirements are implemented.

The geographical placing matters, so that a news item does not turn into misplaced panic: on current knowledge, the tampering that has come to light concerns devices from South-East Asian intermediate trade. No find in a German shop unit is substantiated. The sales halt here is a precaution by retail, not a finding.

Origin, seals and first setup: the three points on your own device

Three things count now if a hardware wallet is sitting with you. First, the origin: a device ordered directly from the manufacturer has a short route behind it. A device from a marketplace listing, from the second-hand market or from a return has a long one. Second, the first setup: a new device generates the recovery phrase itself and shows it to you exactly once. If a ready-made word list came with the documents, or the device was already set up, the funds belong on a freshly created wallet with a new phrase immediately. Third, the behaviour: a device that looks for a mobile or radio connection unprompted during setup does not belong in service.

The hard part here is uncomfortable and should not be glossed over: a foreign component inside cannot be reliably spotted from the outside. Ledger's own laboratory found it only on taking the device apart. Anyone with serious doubts therefore does not rely on a visual inspection but moves the holdings to a wallet whose keys demonstrably originated on another device obtained through a trustworthy route.

Solana Mobile's Seeker app comes preinstalled: access to more than 1,500 applications

Ledger is the first hardware partner to which Solana Mobile is passing its software stack. The Seeker app comes preinstalled on the Atom, linking Solana Mobile's wallet with its own app store for decentralised applications, where the provider says more than 1,500 applications are available. Confirmations run through secure mode here too. Solana Mobile cites transaction volume of more than $13 billion across 154 million transactions for Seeker, and more than 200,000 devices sold across Seeker and the older Saga phone combined. What that means for the price of Solana is not thereby said: a distribution partnership is not an inflow.

$849 and a $100 deposit: the terms of the reservation

Place the price correctly. $849 is well above what a pure signing device costs, and roughly in the range of a high-end smartphone. The Atom is also both at once, and that is exactly where the open question lies: a device that hangs on the network daily, runs apps and carries a camera has a larger attack surface than a device without radio that spends most of its time in a drawer. Ledger answers that with the hard separation through the secure element. Whether that trade works out for you depends on how often you actually sign.

Add to that the gap in time. More than a year lies between reservation and delivery. Over that period prices, competing products and the state of the investigation all change. Nothing argues against deferring the decision until a delivery date and an independent audit are on the table.

What is substantiated and what is not

Substantiated: the presentation on October 15, the price of $849 for the Founder's Edition and $899 regular, the $100 deposit, the partnership with Solana Mobile, the sales halt in seven markets, the three new reseller requirements and the find of the foreign component by Ledger's laboratory. Not substantiated: the total scale of the losses, the effectiveness of the shield and a binding delivery date. Ledger's chief executive Pascal Gauthier summed the product decision up as follows: "For years, our customers have been asking us for a Ledger phone. Today, we answer." On the Seeker integration, Ian Rogers, who serves at Ledger as chief human agency officer, said the integration simply made sense, because it gives users access to the Solana ecosystem without giving ground on security.

Ledger Atom: until delivery in 2027, the device you have today is what counts

The Atom solves no problem you have today, because it arrives in 2027 at the earliest. What takes effect today are the reseller requirements and the halted sales in electronics retail. That is what you align your approach to.

1. Settle the purchase route. While retail is suspended, the short route runs through the manufacturer. Which devices that concerns and how they differ is set out in the hardware wallet comparison.
2. Sort out an interim solution. If no trustworthy device is available to you right now, you need a stopgap for smaller amounts. The options and their limits are in the software wallet comparison.
3. Separate your custody. Amounts you move anyway do not belong on the same device as long-term holdings. For the active part, platforms with an EU licence are an option, listed under regulated crypto exchanges.

Sources on the presentation: Decrypt on the Atom announcement and Bitcoin.com News on price and distribution model.

(As of October 16, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)