Ledger CTO: Most Users Should Still Use Single-Signature Hardware Wallets
Ledger CTO Charles Guillemet issued a warning following the Coldcard firmware vulnerability incident, stating that multi-signature is not an automatic correct answer, and complex configurations may lead to funds being unrecoverable.
Ledger devices have achieved full support for Bitcoin Miniscript, with all spending paths providing clear signature displays; they also support the MuSig2 cryptographic multi-signature scheme, which appears on-chain as a regular single-signature transaction.
The Liana wallet serves as a front-end solution, hiding underlying complexity through Miniscript, allowing users to configure advanced strategies such as inheritance and time-lock recovery without needing to understand script descriptors.
Source: Public Information
ABAB AI Insight
Charles Guillemet has been with Ledger since 2017, initially serving as Chief Security Officer before being promoted to CTO. He has over a decade of experience in cryptocurrency security and has repeatedly warned about supply chain attack risks, including the disclosure of a malicious code incident affecting over 1 billion downloads on NPM in September 2025. Ledger's capital and technology path is clear: Miniscript support was launched in February 2023, MuSig2 went live in April 2025, and in 2026, they aim to promote the ERC-7730 V2 clear signature standard as an open standard recognized by the Ethereum Foundation, forming a complete security stack from the script layer to the signature layer. Similar cases can be compared to the integration path of BitBox02 and Liana—Shift Crypto chose to collaborate with Wizardsardine rather than building their own Miniscript implementation, reflecting a trend of division of labor among hardware wallet manufacturers regarding advanced features: Ledger pursues full-stack in-house development, while BitBox focuses on ecosystem integration. Essentially, this represents a technological substitution: Miniscript replaces the rigid structure of traditional multi-signature with programmable spending conditions, reducing on-chain data exposure while enhancing recovery flexibility; the mechanism is that after the Taproot upgrade, Schnorr signatures allow complex strategies to be compressed into a single-signature appearance, addressing long-standing privacy and cost issues associated with multi-signatures.