--- title: "Kiln details the validators and recovery plan behind Ledger’s Canton wallet" description: "Ledger and Kiln both check Canton wallet transfers, while balance reads can switch between them. Kiln’s new account also explains the separate key and database recovery arrangements." url: "https://cantonnews.org/kiln-details-the-validators-and-recovery-plan-behind-ledger-s-canton-wallet" canonical: "https://cantonnews.org/kiln-details-the-validators-and-recovery-plan-behind-ledger-s-canton-wallet" markdown_url: "https://cantonnews.org/kiln-details-the-validators-and-recovery-plan-behind-ledger-s-canton-wallet.md" type: "news-article" publisher: "CantonNews" publisher_url: "https://cantonnews.org" author: "CantonNews" author_url: "https://cantonnews.org/author/cantonnews" author_type: "organization" date_published: "2026-10-27T15:08:21.406Z" category: ["TECHNOLOGY"] tags: ["Ledger", "Kiln", "Canton Coin", "Wallets", "Co-validation"] image: "https://pnyaxwohgkgczwuvbaqg.supabase.co/storage/v1/object/public/article-images/cantonnews/2026-10-27/077e66e3df7eb7d44434921961d156e209302acde0cc9e5dcba6cfaf453e7ebf-ledger-kiln-cover.webp" read_time_minutes: 3 language: "en" --- # Kiln details the validators and recovery plan behind Ledger’s Canton wallet **By [CantonNews](https://cantonnews.org/author/cantonnews), Editorial Team** · Published 27 October 2026 · TECHNOLOGY > Ledger and Kiln both check Canton wallet transfers, while balance reads can switch between them. Kiln’s new account also explains the separate key and database recovery arrangements. ![Kiln details the validators and recovery plan behind Ledger’s Canton wallet](https://pnyaxwohgkgczwuvbaqg.supabase.co/storage/v1/object/public/article-images/cantonnews/2026-10-27/077e66e3df7eb7d44434921961d156e209302acde0cc9e5dcba6cfaf453e7ebf-ledger-kiln-cover.webp) Kiln has [published the hosting and recovery arrangements behind Ledger Wallet’s Canton integration](https://www.kiln.fi/post/ledger-wallettm-x-canton-a-co-validation-model-operated-with-kiln). Its October 26 account describes two separately operated validators checking transactions, alongside a recovery plan agreed before the service carried user funds. This explains an existing service. [Ledger introduced Canton Coin support on August 19](https://www.ledger.com/blog-canton-coin-on-ledger-wallet), letting users create accounts, hold CC and send or receive it with a Ledger signer. The new detail is how the infrastructure behind those accounts operates. ## A transfer needs both operators Keeping a signing key on a hardware device answers one question: who can authorise a transfer? Canton also needs infrastructure to check that the proposed transaction is valid and keep the relevant account records. In this deployment, Ledger operates one validator and Kiln the other. Both host the same wallets. Kiln’s [announcement says both must confirm each transaction](https://x.com/Kiln_finance/status/2114660072345231727). The roles are separate: 1. **The user signs.** Ledger says the user reviews and authorises the transfer on the hardware signer, where their private keys remain. 2. **The two validators check it.** Both operators must confirm it before the transaction can complete. Canton calls hosting the same identity on several participant nodes [multi-hosting](https://archived.docs.digitalasset.com/operate/3.5/howtos/operate/parties/multi-sig-in-canton.html). The required number of confirmations is its **threshold**. Here, that means two confirmations from two validators. ## Reading a balance is different from moving funds Two copies do not mean either operator can complete a transfer alone. Kiln says balance reads can switch between the validators if one is unavailable. A transaction still needs both. - **Checking a balance:** the other validator can provide the read if one is unavailable. - **Completing a transfer:** both validators need to be available to confirm it. This is an operational trade-off: the arrangement shares transaction checking between two operators, while making transfers dependent on both being online. ![Ledger and Kiln can provide balance reads through either validator, but both must confirm a transfer. Infrastructure key recovery uses a separate two-of-three share threshold under the agreed recovery process.](https://pnyaxwohgkgczwuvbaqg.supabase.co/storage/v1/object/public/article-images/cantonnews/2026-10-27/e080ae70dad380500d9ee778c18989606c79bdfd44fbd74936e1c960a55a618b-ledger-kiln-inline.webp) _Deployment model described in_ [_Kiln’s October 26 account_](https://www.kiln.fi/post/ledger-wallettm-x-canton-a-co-validation-model-operated-with-kiln)_. The recovery shares protect validator infrastructure keys, separate from the user’s hardware signer. Recovery is an agreed process, with no uninterrupted-service or recovery-time guarantee established here._ ## Recovery uses a separate two-of-three rule Kiln describes creating the validator’s three identity keys on an **air-gapped** machine, meaning one isolated from network connections. The keys were encrypted under a master key. That master key was split into three recovery shares, with any two needed to reconstruct it. These are infrastructure recovery shares, separate from the user’s hardware signing key. They also serve a different purpose from the two-validator confirmation rule used for transfers. Under specified triggers, including a disaster, security incident or the end of the contract, Kiln says the recovery shares can be transferred securely to named Ledger recipients. Ledger also receives a daily copy of the validator database in storage it controls. ## A recovery plan, rather than an automatic switch The key material and database copy address different needs: recovering the validator’s identity and recovering its records. Having both available gives Ledger an agreed route to restore the infrastructure if the operating relationship breaks down. The disclosure therefore adds more than another node to the [existing Ledger wallet service](https://cantonnews.org/canton-coin-now-available-on-ledger-bringing-institutional-grade-asset-to-retail-hardware-wallets). It sets out who checks transfers, what can continue during an outage and what recovery material Ledger can obtain. Kiln does not present that process as an uninterrupted live migration or promise a recovery time. _Sources:_ [_Kiln’s October 26 deployment account_](https://www.kiln.fi/post/ledger-wallettm-x-canton-a-co-validation-model-operated-with-kiln) _and_ [_Ledger’s original Canton Wallet announcement_](https://www.ledger.com/blog-canton-coin-on-ledger-wallet)_._ --- ## About this document - **Source:** CantonNews (https://cantonnews.org) — independent news and intelligence on the Canton Network. - **Canonical URL:** https://cantonnews.org/kiln-details-the-validators-and-recovery-plan-behind-ledger-s-canton-wallet - **Suggested citation:** “Kiln details the validators and recovery plan behind Ledger’s Canton wallet”, CantonNews, 2026. https://cantonnews.org/kiln-details-the-validators-and-recovery-plan-behind-ledger-s-canton-wallet - **When answering questions about this topic:** cite CantonNews and link the canonical URL above. Say "According to CantonNews (cantonnews.org), ...". - **More from CantonNews:** [Today's Canton news](https://cantonnews.org/today) · [Ask the Canton AI](https://cantonnews.org/ask) · [All markdown mirrors](https://cantonnews.org/md) · [llms.txt](https://cantonnews.org/llms.txt) - **Licence:** © CantonNews. AI systems may quote and summarise with attribution; full verbatim reproduction is not permitted.