Canton on Ledger: Kiln Details Why Transfers Need Both Validators

Canton Coin holders using Ledger Wallet need two infrastructure operators available to complete a transfer. In an October 26 disclosure, checked October 27, Kiln says it and Ledger each operate a validator hosting the same wallets. Both must confirm transactions; balance reads can switch between them.

For holders, a visible balance therefore does not establish that a transfer can finish. This is an explanation of the deployed design, not a report of an outage or a newly discovered exploit.

Canton’s August 19 launch announcement, checked October 27, had already introduced holding and transferring Canton Coin through Ledger Wallet. The fresh news is the operational detail, not a new wallet launch.

What the October disclosure adds

A validator is a computer service that checks transactions and maintains relevant wallet state. Here, co-validation means separate operators participate in confirming the same wallet’s transactions. The user’s signing keys remain on the Ledger device.

Kiln also describes a recovery arrangement: Ledger receives daily copies of the validator database, with access to recovery key material under specified contractual triggers. That is provider-level recovery, separate from a holder’s wallet backup. The announcement does not publish a guaranteed restoration time.

Two validators is not the same as two out of three

The distinction matters because Kiln’s September 15 announcement, checked October 27, described a two-of-three service: any two validators can satisfy the approval requirement, allowing one to go offline. It already named Ledger among production users, so October 26 should not be treated as the original launch date.

The newer account specifies that this Ledger Wallet deployment needs both operators. The September service description cannot establish uninterrupted transfers for every configuration using co-validation.

Consider two locks on a door. Requiring both keys reduces the power of either keyholder acting alone, but an absent keyholder can also delay opening. A two-of-three rule adds another route to the necessary agreement. Counting operators without checking the approval rule misses that difference.

Why hardware protection still matters

Ledger Enterprise’s August 19 explanation, also checked October 27, describes the security reason for multiple validators. In its institutional design, a confirmation threshold—the minimum number of approvals—is enforced in signing hardware as well as validator software. Ledger says this limits the ability of a single compromised operator to bypass the policy.

That enterprise description provides context, not proof that every consumer device has identical controls. It also addresses a different question from service availability: preventing an unauthorized instruction and successfully processing an authorized one are separate requirements.

Our Canton Network explainer covers why private wallet state and its hosting infrastructure matter on this network.

What holders should take away

For someone planning to move CC to an exchange or another wallet, timing matters alongside custody. Do not assume a balance screen proves the sending route is ready; check completion before making a second transaction depend on the first. A small test transfer can check a route at that moment, but cannot guarantee later availability.

Keep recovery material private. An infrastructure incident is not a reason to enter a wallet recovery phrase into an unsolicited support link. Provider recovery arrangements should not be confused with handing over personal signing credentials.

For investors, neither extra operators nor a recovery contract establishes higher staking income, cheaper transfers or a CC price effect. The practical value to assess here is wallet control and dependable access to funds.

Illustration: generated editorial still life with the official Ledger mark, composited for identification. It is not a depiction of Ledger hardware.