All news is verified and thoroughly reviewed by leading blockchain experts and seasoned industry insiders.
summary
- Ledger has opened its Agent Stack toolkit to the public, allowing AI agents to manage cryptocurrency wallets while private keys remain locked inside the hardware.
- Every transaction that transfers value still requires manual confirmation to the ledger signer before it can be executed.
- MoonPay and Shisa.ai are already running production tools built on the new architecture.
- Ledger plans on-device proxy identities and human verifiers later in 2026.
Ledger opened its Agent Stack to the public on July 16, 2026, giving developers a standardized way to let AI agents read cryptocurrency balances, analyze portfolios, and then formulate transactions that would move funds, all without touching the private keys behind them. The Paris-based hardware wallet maker built the release around one restriction: an agent can formulate a swap or payment, but the decision to execute it still has to go through the press of a physical button on a Ledger device, and is confirmed by the person who owns the wallet. Launch follows The preview period began on June 10 It has been running with more than 1,000 test agents and represents the first public delivery of the company’s 2026 AI security roadmap.
Toolkit designed to stop when you sign
Agentic AI has spent the past two years automating research, monitoring, and drafting for cryptocurrency users, and the obvious next step is to allow agents to move funds themselves. This step faces a specific trust issue. Hand over your private keys to an agent, and a single hallucinated price, bad instruction, or successful flash injection attack can drain the account in seconds. Block the agent from accessing the wallet altogether, and most of the promised efficiency disappears with it. Ledger’s answer keeps agents fully capable on the reading and parsing side while drawing a hard line on execution. The company puts the rule in three words used in developer documentation: agents suggest, humans approve.
Four units, one common boundary
The Agent Stack ships in four separate, buildable pieces Instead of one locked-in product, the developer only adopts what the specific use case actually needs.
| Module | job |
|---|---|
| Device management skillset | Markdown-based code that plugs proxy frameworks like Claude Code, Codex, or Cursor into a Ledger site without custom wallet integration code |
| Ledger Wallet CLI | Allows the agent to freely check balances and review history, as they are read-only. Setting up a send or swap works too, but anything that would move the value pauses there for actual confirmation |
| Enterprise Ledger CLI | Connects agents to Ledger Enterprise so they can craft transactions and support governance workflows for enterprise accounts without ever holding a key |
| Enterprise Ledger Multisig CLI | Allows agents to craft and query multisig actions for enterprise accounts, although quorum approval and hardware signature are still a gateway to anything actually being executed |
Why screen and thumb override software permission
The architecture is based on a principle that Ledger calls WYSIWYS, what you see is what you expect. The agent sets up a transaction within its software environment, but the approval step occurs completely outside of that environment, on the trusted display of the physical location that displays the exact transaction details before anyone confirms it. Since the private key never leaves the secure device chip, a compromised agent, poisoned skill, or targeted injection attack can still ask the signer to agree to something. None of them can agree to this without someone actually being present. Software-only wallet permissions, even carefully designed ones, ultimately live within the same execution environment that the attacker is trying to control. Hardware puts the final decision somewhere the code can’t reach it.
The ledger says the numbers justify the friction
Ledger supports the added approval step with two external characters. The 26.1% impairment rate comes from Independent study, Agent Skills in the Wildwhich surveyed more than 31,000 published agent skills and found that this share carries at least one flaw. The human error number is a widely cited industry number, which Ledger included in its launch materials without attributing it to a specific study.
| metric | appearance | source |
|---|---|---|
| AI agent skills with at least one vulnerability | 26.1% | Agent Skills in the Wild (arXiv, January 2026) |
| Security breaches are due to human error | about 60% | Unattributed industrial character, cited by Ledger |
| Agents tested during private inspection | More than 1000 | Ledger preview post on June 10 |
Ledger says the AI attack surface is expanding faster than most defenses can track, which explains the first figure. The second number goes in the other direction: The company’s case suggests that agent-assisted onboarding can actually reduce normal errors even with the addition of one manual step at the finish line.
What changes for traders, funds and developers from here?
MoonPay and Shisa.ai already have production tools running on the architecture, and MoonPay’s integration allows the agent to define and set up trades while private keys remain locked into the hardware and each transaction still requires the push of a button. The Enterprise Multisig CLI pushes the same logic into corporate coffers, where quorum approval already slows down implementation for other reasons and confirmation of additional devices changes little in practice. Retail and high-frequency use cases come into more tension with the model. A trading agent that detects an arbitrage window measured in milliseconds cannot wait for a person to glance at a device screen, and competing wallet designs built on smart contract computation abstractions already allow bots to execute autonomously within spending limits set in advance by the owner. Ledger is betting that security outweighs the cost of speed for most users; Whether this applies to latency-sensitive strategies is a separate question that the market will answer independently of this release.
Ledger has already outlined his next steps. The agent ID goes live later this year It will associate each agent with a registered hardware identity registered on-chain, replacing the deceptive software chains that agents currently use to identify themselves with services and each other. A separate human proof certificate is intended to allow the counterparty to cryptographically verify that a real person authorized a particular action, not just that the signer approved it. Meanwhile, Ledger is backing a $5,000 developer bounty on College.xyz and offering a $10,000 prize pool at ETHGlobal New York for teams building payment and authentication tools for agents on the new suite, a near-term push to get more of the agent building community testing the hardware-gated model before identity and authentication tools arrive.
