Ledger Bets on Connected Atom Signer Amid Implant Fallout

Ledger announced Atom, an Android-based touchscreen device with a built-in cellular connection, at its Op3n event in Paris on Thursday, less than a week after the company confirmed that tampered Ledger wallets sold in Southeast Asia had been used to steal users' recovery phrases.

The launch comes as Ledger is still investigating how covert implants ended up inside devices sold by reseller CryptoBilis. The implants read the 24-word recovery phrase from the screen during setup and transmitted it over LTE using an eSIM, in an incident onchain researchers have linked to more than $86 million in suspected thefts. Ledger has since asked resellers in seven Asian markets to pull its devices from shelves, a second tampered unit has surfaced in Singapore, and rival Trezor has moved to cut its own reseller network, as we previously reported. Ledger has not yet said who tampered with the devices or where in the distribution chain it happened.

Atom is a more complex device than anything Ledger currently sells. According to Ledger's product page, it runs a full Android environment with direct internet access over a data-only 4G/5G connection, alongside a separate Secure Element running Ledger OS that handles keys and signing. When a user signs a transaction or approves an AI agent request, an FPGA chip cuts the Android side off from the display and touch panel and Ledger OS takes over the screen. Ledger says a fully compromised Android environment cannot view or alter that exchange. The device will also ship with Solana Mobile's Seeker app and dApp Store preinstalled, according to a joint announcement, and will support Ledger's system for approving transactions proposed by AI agents.

Putting a cellular radio in a signing device is a notable design choice given how the CryptoBilis attack worked. The implants needed to add their own eSIM to get recovery phrases off the device, and Atom now comes with that connectivity built in. Ledger's architecture is designed so the Android side never sees the seed, but an always-connected device also raises a separate network privacy problem. Cellular identifiers such as the SIM and device IDs are visible to carriers and can be tied to a user's identity and location, which could link a known crypto holder to a specific device wherever it connects. Ledger has not said how Atom will prevent that.

Ledger said Atom will detect attempts to open the enclosure or remove the screen, that its tamper sensors run on a separate battery, and that the device will be sold only through Ledger's own website. Reservations for a Founder's Edition are open with a refundable deposit. The Block reported a price of $849, with deliveries expected from summer 2027 pending certification, more than twice the price of Ledger's most expensive current signer.

The announcement asks users to trust Ledger with a more connected and more complicated device at the moment that trust is weakest. The company's immediate problem is its existing product line: buyers want to know that a simple signer bought from a store has not been opened, and that Ledger can account for every point in its supply chain. Until Ledger publishes its findings on where the CryptoBilis devices were altered, Atom's tamper protections will be judged against a failure the company has not yet explained.