Understanding Ledger Wallet’s Account Derivation: Why Your Bitcoin and Ethereum Addresses Change and What It Means for Security

A user receives a Bitcoin payment to their Ledger wallet, connects the device weeks later, and finds that the receiving address has changed. Another user notices their Ethereum address is different from the one they copied last month. Neither has moved funds or reset their device. The cause is not corruption or a security breach. It is the standard behavior of hierarchical deterministic wallet derivation, a feature that improves both privacy and key management but often confuses people accustomed to single-address wallets or centralized exchanges.

Understanding why a ledger wallet generates multiple addresses for the same account, and how those addresses relate to a single Secret Recovery Phrase, is essential for secure fund management and recovery. The mechanism protects against address reuse tracking, simplifies backup, and makes account restoration straightforward. Yet the implementation details matter. A user who misunderstands address derivation may unnecessarily resend funds to a “new” address, lose track of which addresses hold value, or misjudge the security relationship between their hardware device and the application interface.

The core principle: one seed, infinite addresses

A Ledger hardware wallet stores a single Secret Recovery Phrase (typically 24 words) that becomes the root of an entire tree of key pairs. This phrase is never exposed to the computer or phone running the companion software; it remains on the device. From that root, the wallet uses a standardized mathematical process called BIP32 (Bitcoin Improvement Proposal 32) to derive child keys. Each child key can then produce its own child keys, creating a hierarchy that extends down many levels.

In practice, the hierarchy is organized to separate concerns. The first level of branching differentiates cryptocurrencies: a separate path for Bitcoin, another for Ethereum, another for Litecoin, and so on. The next level typically separates account instances (your “main” Bitcoin account from a “savings” account, for example). Below that, addresses are generated sequentially. This structure means that a single Secret Recovery Phrase can control thousands of addresses across dozens of cryptocurrencies, and every single one of those addresses is mathematically derived from the same 24-word seed.

The benefit is that you need only secure and backup one phrase. If your Ledger device is lost, stolen, or damaged, you can purchase a new one, enter the same Secret Recovery Phrase, and every address and every fund associated with the original device will be accessible again. No per-address backup is needed. No separate recovery method for Bitcoin, Ethereum, or any supported coin is required. The phrase is the universal key.

However, the fact that this derivation is automatic and deterministic means that the addresses are not random. They follow a pattern known to anyone who has the Secret Recovery Phrase. This is why protecting the phrase is paramount. An attacker with the phrase can derive all addresses and spend all funds. An attacker without the phrase cannot. The ledger wallet application running on your computer knows some of these derived addresses but does not need to store the phrase itself.

Why Ledger Wallet generates a new address for each transaction

One address per transaction is not a requirement of Bitcoin or Ethereum protocol. Both cryptocurrencies allow a single address to receive multiple payments. Many centralized exchanges use this model: you have one deposit address that accumulates all your transfers. However, there are significant privacy and operational disadvantages to address reuse. When you publish the same address repeatedly, every payment to that address becomes explicitly linked in the public blockchain. An observer can easily sum all payments to that address and identify you as the receiver of that total amount.

A Bitcoin wallet that generates a new address after each transaction (or in preparation for each receiving action) prevents this simple aggregation. Each payment goes to a different address, making it harder for an external observer to connect them to a single owner. This is not absolute privacy—sophisticated analysis can still make inferences from timing, amounts, and transaction patterns—but it raises the cost and reduces the obviousness of the tracking.

The ledger wallet application manages this by maintaining a counter for each account. When you open the account view and request a receiving address, the application queries the Ledger device to derive the next address in sequence. That address is displayed on the screen and on the device’s display (if you approve it). The application tracks which addresses have been used and typically displays the first unused address when you request a receive operation again.

For Ethereum and ERC-20 tokens, the benefit of address derivation for privacy is lower because Ethereum transactions show balances and interaction histories on-chain regardless of address reuse. However, the same mechanism still applies. Each address in an Ethereum account is derived from the same master key, and the application can still present an unused address for each receiving action, maintaining consistency with the Bitcoin model even though the privacy improvement is modest.

Understanding the gap limit and address scanning

The ledger wallet application cannot derive every possible address at startup because there are infinitely many. Instead, it uses a concept called the “gap limit”—typically set to 20 addresses. The application derives addresses sequentially and stops when it encounters a certain number of consecutive addresses with no transaction history. If addresses 0 through 15 have received payments, address 16 is unused, address 17 is unused, and so on up to address 20, the application assumes that address 21 and beyond will not receive funds (or have not yet received them in a way the wallet has detected).

This approach is efficient for most users but creates an edge case. If you manually request a receiving address, and that address is far ahead of the highest address ever used, the application might not detect it if you switch devices or wallets. For example, if you generate address number 35 manually and then close the application, and later open a different wallet app that also derives from the same Secret Recovery Phrase, that second app might not scan beyond address 20 and would miss the funds sent to address 35.

In practice, this is rare because the ledger wallet application keeps track of the highest address index it has encountered and adjusts the gap limit intelligently. If you regularly use the application and generate addresses through its interface, the wallet learns your pattern. But the possibility underscores an important principle: the address is derived from the phrase, not stored in the application. If you ever need to recover using a different wallet software (importing the Secret Recovery Phrase), you may need to manually adjust the derivation depth or gap limit settings to ensure that all addresses are scanned.

How hardware signing protects derived addresses

The fact that the ledger wallet application can see and display addresses does not mean it can spend from them. When you initiate a transaction, the application prepares the transaction details and sends them to the Ledger device. The device verifies the transaction, checks that the destination address is not one of your own addresses (as a fraud prevention measure), and then signs the transaction using the private key corresponding to the address you selected. The signature is sent back to the application, which broadcasts the signed transaction to the blockchain.

The private keys for all derived addresses live on the device and never leave it. The computer application has no access to these keys. This is why connecting a Ledger device to a compromised computer does not automatically expose all your funds: the computer can see addresses and balances, but it cannot initiate a valid transaction without the device’s physical confirmation and the cryptographic signature that only the device can produce.

Address derivation path information is not secret. Anyone can derive the same addresses from the Secret Recovery Phrase. But deriving an address is not the same as deriving the private key associated with it without knowing the phrase. The blockchain can see that a transaction is coming from a particular address, but no observer can spend from that address unless they have the phrase and the corresponding private key derivation capability.

This separation is also why it is safe to use a Ledger hardware wallet on a public computer or a device you do not fully control, provided you physically verify transaction details on the device’s screen before approving them. The application might show a fraudulent destination address on the screen, but if you confirm the details on the device itself, you can catch the deception because the device will display the actual address being signed.

Reconciling multiple wallets and recovery scenarios

A user who has backed up their Secret Recovery Phrase can theoretically restore their full account history using any wallet software that implements the same derivation standard (BIP44 for Bitcoin, BIP32 for others). Downloading and installing Ledger’s official software at ledger wallet onto a new computer, or even using a different vendor’s wallet software, should derive the same addresses from the same phrase.

In practice, variations exist. Different wallets may use slightly different default derivation paths. Some wallets apply additional steps (like account name derivation) that others do not. A wallet might have a higher or lower default gap limit. Segwit vs. legacy address format choices also affect the final address for Bitcoin. These differences mean that if you restore a phrase into a wallet using different settings, you might see fewer detected addresses or different address formats than you expect.

For this reason, it is important to understand which derivation path and address type your Ledger wallet is using. The application typically shows this information in settings (for Bitcoin, you can see whether you are using native Segwit, Segwit, or legacy addresses). When recovering funds after a hardware failure, using the same Ledger official application, with the same settings, ensures that addresses match perfectly.

An Ethereum wallet or Bitcoin wallet created from the same phrase in a different application might display different balances temporarily because the scanning depth differs, but connecting the Ledger device itself to that new application and re-scanning with a higher gap limit should reveal all funds. The phrase is the authoritative source; the application is a tool for accessing it.

Privacy considerations: address reuse and external observation

Even though the ledger wallet application generates a new address for each receiving operation, users sometimes manually record an address and reuse it to receive multiple payments (from an employer, a service, or a trusted contact). This is not unsafe from a security standpoint—both payments to the same address are equally valid and spendable—but it does reduce privacy. An observer can easily see that both payments went to the same address and attribute them to a single recipient.

The application discourages this by presenting the next unused address whenever possible, but the user always has the option to copy or share an old address. Over time, if you reuse an address, all payments to it become explicitly associated. When you eventually spend from that address, the blockchain will show the combined input value, potentially revealing the total amount received.

Some users also notice that they can see the same Ethereum address across different explorers or applications because Ethereum derivation is not address-sequence-based in the same way Bitcoin is. For Ethereum, each account typically has a single “receiving” address (because Ethereum does not have change addresses). Receiving multiple payments to the same Ethereum address from your Ledger wallet is normal and expected; it does not reduce security, only privacy against observers analyzing the blockchain.

Practical steps for managing addresses securely

First, use the ledger wallet application regularly to check your balances and receive transactions. Do not manually record an address for regular use; instead, request a fresh address from the application each time you need to receive payment. This keeps your interaction model aligned with the wallet’s automatic address advancement.

Second, when you copy a receiving address to share with someone else, do so from the application display, and verify the address on your Ledger device’s screen if available. Some models display the address on the device when you confirm receiving operations, allowing you to verify that the application is showing the same address you are about to share.

Third, back up your Secret Recovery Phrase carefully and test your recovery process. Do this by restoring the phrase into a separate Ledger device (if you have one available) or by using the official ledger wallet software on a fresh computer to ensure that you can derive the same addresses. Do not test recovery by entering the phrase into an online tool or non-official software.

Fourth, if you intend to use the same phrase with multiple applications or devices, document the derivation path and address format settings used by each. This prevents confusion when balances appear different or addresses do not match immediately. Keep notes on which application was primary, which addresses have been actively used, and whether you have high-value addresses that are far ahead in the derivation sequence.

Looking ahead: standardization and future wallets

Address derivation standards like BIP32 and BIP44 have been widely adopted, making it increasingly likely that different wallet applications will derive the same addresses from the same phrase. However, new standards and wallet features continue to emerge. Silent Payments on Bitcoin, for example, represent an alternative receiving model that does not use sequential addresses at all; instead, a sender uses a single public key to derive a unique address for each payment.

Ledger’s continued support for Bitcoin, Ethereum, and other standards means that as these standards evolve, the hardware wallet’s core function remains unchanged: secure key derivation and signing. The ledger wallet application will adapt to support new standards while maintaining compatibility with existing accounts. Users should expect that understanding address derivation remains relevant because the principle—one master seed, infinite derived keys—is foundational to how modern hardware wallets work.

The most important takeaway is that address change is not a flaw or a sign of trouble. It is a deliberate privacy and operational feature. Your Bitcoin wallet, Ethereum wallet, or any account derived from your Secret Recovery Phrase will continue to generate new addresses because that is how the standard design protects you. Trusting that process, rather than fighting it by manually reusing addresses, is the best path to both security and privacy.