Ledger Recover
A 0-to-1, opt-in recovery for self-custody — designed so that losing a seed phrase no longer means losing everything. Lead design on a product now earning millions a year.
In crypto, one lost seed phrase means everything is gone
Self-custody is one of the hardest problems in crypto. If you hold your own keys, you also hold a 24-word seed phrase — the only backup to your wallet. Lose both your Ledger and that seed phrase, and your funds are gone for good.
Ledger Recover was built for exactly those people: newcomers who want the peace of mind of a backup, just in case. It set out to solve one of the biggest pain points in the space — the quiet, constant fear of losing everything to a single mistake.
Designing the experience as the architecture took shape
I joined at the very beginning, as the only designer, sitting in the technical meetings where the security architecture was still being mapped out. The system and the user experience took shape side by side — I designed the flows as the diagrams were drawn, in step with the constraints forming behind them.
That closeness was the whole point. Every flow had to be checked from both sides at once: something a real person could actually understand and get through, and something that was genuinely feasible given the technical constraints. Designing the two together is what kept them aligned.
Aligning teams, devices and external partners
Behind that one calm flow sat a whole ecosystem, all of it being built in parallel. On the inside: the hardware teams (Ledger Stax, Nano, Flex), the device software and infrastructure teams, and Ledger Live engineering. On the outside: an external provider for identity verification, and several backup providers — the secret split into three encrypted fragments, each held by a different one.
My role was to design on top of all of it at once: an experience that stayed technically possible across every moving part, while still being the simplest, clearest journey we could give the user.
One experience, many screens
The same flow had to be designed for several surfaces at once — the Ledger Live app on mobile and desktop, and the screens on the Ledger devices themselves. And "the device" isn't one thing; it's a whole family: some have a tiny non-touch screen, others a larger touchscreen, and some run leaner firmware with hard limits on how much you can show at all.
So each step had to stay coherent across the app and the device, and across every device at once — the same moment, redrawn for very different surfaces without ever losing the thread.
Sharing the work with Tony Fadell & David Sloo
I had the chance to share my flows and screens with Tony Fadell (iPod, iPhone, Nest) and David Sloo (Microsoft, General Magic), who were advising Ledger.
With Fadell, the sessions were fast and high-stakes — an hour of his time, five to ten minutes per team, so you came extremely prepared. What stuck with me was how he'd move from one topic to the next and stay sharp and relevant on every one, and how he could energise a whole team and pull it toward a single, clear vision.
I worked more closely with David Sloo, mostly in the ideation phases — exploring what was possible and being guided toward the strongest UX directions.
A small change, an outsized impact
Most of my energy went into the year and a half of building the product from nothing. But once it shipped, a different kind of work began: tightening a long acquisition funnel — from the first entry screen through setting up the subscription, connecting the Ledger and verifying identity, all the way to activation.
It wasn't where I spent the most time, but its impact was hard to ignore. We leaned on data and A/B-tested the upsell screens; one change alone lifted acquisition by roughly 30% — a gain that compounded across the entire funnel.
The flow, in the interface
Key moments from the onboarding and recovery flows — across mobile and device.