How to Secure Your Ledger with COLDCARD

Use Coldcard as the offline source of a separate Ledger wallet by deriving a BIP-85 child mnemonic and entering that child on the Ledger device. Never import your Coldcard master seed. The parent stays on Coldcard; Ledger receives one dedicated multi-asset child.

This isolates the Coldcard wallet from the device kept for stablecoins or other networks. It does not make Ledger air-gapped, change Ledger OS, or remove the need to trust and verify device apps, companion software, and transaction details.

Verified scope: Ledger recovery screens differ across Nano, Flex, Stax, and newer signers. Shared BIP-39 recovery and Recovery Check behavior were verified from official Ledger sources on July 10, 2026. Follow the official instructions for your exact model.

Why keep a Ledger for other assets?

Coldcard is deliberately Bitcoin-only. Some users still need dollar stablecoins, another network for work or payments, or a token and software integration that Coldcard will not support.

Ledger Wallet, formerly Ledger Live, currently advertises support for more than 15,000 assets. Ledger publishes workflows for USDT, USDC, DAI, and other stablecoins across multiple networks. That broad compatibility is a practical reason to keep a Ledger even when Bitcoin savings remain on Coldcard.

The broader scope has tradeoffs. More device apps, networks, smart contracts, token formats, and companion services create more code and more decisions. The Coldcard-derived child does not erase those risks. It limits their seed exposure so the Coldcard master is not also the Ledger recovery phrase.

Every asset derived from the Ledger child shares one compromise domain. If that child leaks, assume every associated account on every network is at risk.

Use a child seed, not the master

Entering the Coldcard master words into Ledger would make a connected, multi-asset signer another home for the root of your Bitcoin wallet. It would also allow the same words to derive many non-Bitcoin accounts.

Use a dedicated child instead:

Coldcard parent
└── BIP-85: BIP-39 / English / 24 words / index N
    └── Ledger wallet
        ├── Network and account A
        ├── Network and account B
        └── Stablecoin token accounts

The same parent context and index reproduce the same 24 words. A compromised child does not reveal the parent through BIP-85. A compromised parent can reproduce the Ledger child and every sibling.

This is seed provisioning, not two-factor signing. After restoration, Ledger signs the child accounts without Coldcard.

Before you start

Use a new, empty, or deliberately reset Ledger. Never reset a funded device until its existing recovery phrase has been checked and you have a safe plan to move every asset it controls.

You need:

a Coldcard Q or Mk5 with the intended parent;
a verified backup of that parent;
a genuine Ledger device in a known state;
the current official Ledger Wallet application;
official instructions for your exact Ledger model;
a private workspace without cameras or observers;
paper for BIP-85, chain, token, account, and derivation metadata;
small amounts of the correct native fee assets for testing.

Run Ledger's genuine-device checks during official onboarding. Avoid an unintended Coldcard passphrase or temporary seed because recovery requires the same parent context.

Derive and restore the Ledger seed

1. Confirm the parent context

Sign in to the Coldcard wallet that will act as the parent. Confirm its backup and that no unintended passphrase or temporary seed is active.

2. Open BIP-85

Use the model-specific path:

Mk5 and Mk4: Advanced/Tools > Derive Seed B85
Q: Advanced/Tools > Derive Seeds (BIP-85)

Choose BIP-39, English, and 24 words. Ledger devices normally generate 24-word recovery phrases, and Ledger supports restoration from compatible BIP-39 phrases.

3. Assign and record an index

Choose an unused index from 0 through 9999 and record:

Purpose: Ledger multi-asset wallet
Standard: BIP-85
Application: BIP-39
Language: English
Words: 24
Index: ____
Ledger model: ____

The index is metadata, not a secret factor.

4. Display the child on Coldcard

Read the words from the Coldcard screen. Do not export the child through MicroSD, Virtual Disk, NFC, QR, or USB keyboard emulation for this workflow.

Do not type the words into Ledger Wallet, a browser, a phone, or a computer. Ledger's own guidance says the Secret Recovery Phrase must be entered only on the Ledger device.

5. Restore the Ledger

Follow the official setup guide for your model. The shared flow is:

Turn on the Ledger and choose Restore from recovery phrase.
Set and confirm a new device PIN.
Select a 24-word recovery phrase.
Enter the child words in order on the Ledger device.
Wait for the device to finish processing and report that it is ready.
Complete the genuine-device check in official Ledger Wallet onboarding.

Nano models use their physical buttons for word entry. Touchscreen models use a different interface. Do not translate one model's exact clicks into a universal Ledger procedure.

Verify the seed and accounts

1. Reproduce the child

Exit the first Coldcard display. Return to the same parent context and derive BIP-39, English, 24 words, at the recorded index.

2. Use Recovery Check

Install Ledger's Recovery Check device app through the official Ledger Wallet application. Open Recovery Check on the Ledger, select the 24-word length, and enter the newly displayed child on the Ledger device.

The app should confirm that the phrase matches the wallet protecting the device. If it does not, stop. Do not fund any account. Recheck the Coldcard context, word count, language, index, and word order.

Recovery Check is safer than intentionally resetting a newly loaded device because it tests the phrase without destroying the current wallet state.

3. Install only required device apps

Install the official device app for each network you will actually use. Then add the corresponding account in Ledger Wallet or a verified compatible companion.

The seed does not preserve the list of installed apps or the account list displayed in Ledger Wallet. Those interfaces must be rebuilt during recovery.

4. Verify every receive address

For each network:

Generate a receive address in the companion.
Display the address on the Ledger device.
Compare the full address and network before using it.
Send a small test amount.
Confirm a test spend if the operational plan depends on outgoing access.

A successful test on one network does not prove another network, derivation path, or token account is correct.

Document multi-chain recovery

The child mnemonic recreates deterministic keys. It does not record where those keys were used.

Maintain an offline inventory for every funded account:

Ledger model and wallet label: ________
Asset and ticker: ________
Network: ________
Token contract or asset identifier: ________
Device app: ________
Companion wallet: ________
Account number: ________
Derivation path/address type: ________
Verified receive address: ________
Native fee asset: ________

Stablecoin recovery makes this mandatory. USDT on Ethereum is not the same account or transfer network as USDT on Tron, Polygon, or another chain. A ticker alone cannot reconstruct the wallet.

Record non-default paths and third-party companions explicitly. A correct seed with the wrong network, account, or path can produce a valid but apparently empty wallet.

Store this inventory separately from the child mnemonic. It is privacy-sensitive, but normally cannot spend without the seed.

Decide on optional recovery services

Ledger Recover is optional and opt-in. On supported devices, it encrypts seed entropy inside the secure element, splits it into three fragments, and distributes those fragments to three companies. Recovery uses two fragments after identity verification.

If you enable Ledger Recover for this child, you are adding another recovery path to the Ledger child. You are not changing the Coldcard hierarchy:

Coldcard plus the correct BIP-85 context can still reproduce the words;
Ledger Recover can restore the child's keys to a supported Ledger after its identity process;
Ledger Recover does not return the human-readable 24 words.

That may be useful for some users and unacceptable to others. Decide deliberately. Do not describe the service as mandatory or automatic.

Ledger Recovery Key is another optional backup for supported touchscreen devices. It is not required by this workflow. Every additional recovery mechanism should be documented as a separate path and protected for the value of the child.

Know the limits

Ledger does not become air-gapped

The seed originates offline on Coldcard, but normal Ledger use still follows the connectivity and companion model of the Ledger device. Verify transaction details on the Ledger screen rather than trusting the host display.

If the child is stolen, every account derived from it may be exposed. BIP-85 separates the child from the Coldcard parent; it does not isolate the child's many networks from one another.

Stablecoins add separate risks

A hardware signer protects keys. It does not remove issuer, freeze, redemption, smart-contract, bridge, liquidity, or network risk. This guide addresses seed custody and recovery only.

The parent can recover every child

A stolen Coldcard parent backup and its required passphrase context can reproduce the Ledger child and siblings. Protect the parent for their combined value and privacy.

BIP-85 is not multisig independence

Do not derive several multisig cosigners from sibling indexes under one Coldcard parent. Generate cosigner seeds independently so one root compromise cannot recreate the quorum.

Native Ledger generation remains valid

Ledger can generate its own 24-word phrase. Use the BIP-85 design only when deterministic recovery under a Coldcard parent is worth the concentrated root and metadata burden.

Sources and verification

Verified on July 10, 2026. Recheck model-specific recovery screens, supported assets, app names, and optional-service availability before publication.

How to Store a Seed Phrase

Plan physical storage for a child backup that can control several networks.

Read article

What Is a Bitcoin Passphrase?

Learn how an exact passphrase creates a separate wallet and recovery duty.