Cake Wallet Web vs Native: Why Ledger Live Abandoned Browser Support for Hardware Wallet Integration

In 2024, Ledger formally discontinued browser-based hardware wallet interaction, moving exclusively to native desktop and mobile applications. That decision was not cosmetic. Browser environments expose hardware wallets to attack surfaces that native applications can mitigate through operating-system-level isolation, device-specific encryption, and direct hardware communication protocols. The security implications are significant enough that every serious hardware wallet manufacturer—Ledger, Trezor, and the providers of air-gapped signers—has converged on the same architectural requirement: private keys and signing operations must be isolated from a general-purpose web runtime.

Understanding why this shift happened requires examining what a browser can and cannot do when connected to a hardware wallet. A web interface running in a browser tab has no direct access to USB ports, secure enclave hardware, or device-level encryption. That isolation sounds protective, but it creates a gap. The browser must mediate communication between the wallet software and the signing device, and in that mediation lies the entire attack surface. Cake Wallet’s native implementation on iOS, Android, macOS, and Linux demonstrates the opposite principle: a dedicated application can enforce signing policies, validate requests before they reach the hardware, and control what information the user sees. The result is not just more privacy features—it is a fundamentally different threat model.

The browser sandbox isolates the user from control, not the attacker from the keys

A browser’s sandbox is designed to prevent one website from accessing another website’s data, not to prevent a webpage from attacking the user’s hardware. When a user visits a website that connects to a hardware wallet through a browser extension or WebUSB interface, that webpage has read and write access to a communication channel. The attacker does not need to break the browser’s sandbox. The attacker merely needs to control the webpage that the user visits while the hardware wallet is plugged in.

This distinction explains why hardware wallet manufacturers moved away from web interfaces. A malicious or compromised webpage can see every request before the hardware wallet does. If the user is approving a transaction, the webpage can display one address and amount on screen while sending a different address and amount to the signing device. The user approves based on what they see in the browser; the hardware wallet signs what the attacker requested. This attack, sometimes called a “display spoofing” or “blind signing” scenario, does not require breaking cryptography. It requires only controlling the interface between the user and the device.

The fundamental problem is that a browser page has no way to verify that the request it is displaying matches what the hardware wallet will actually sign. Browser extensions like MetaMask or WalletConnect plugins can mitigate this by building in some request validation, but they still operate within a browser process that can be manipulated, redirected, or attacked through DNS hijacking, SSL stripping, or compromised scripts. A native application like those available through cake wallet web documentation can instead verify at the operating-system level that the signing request matches what was displayed, because the application controls both the user interface and the hardware communication in a single, hardened context.

Hardware wallet integration in native applications: The Ledger and Trezor model

Ledger Live and Trezor Suite are native desktop applications. They do not run in a browser. When you connect a Ledger or Trezor device, the native application establishes a direct USB connection, issues signing requests, and communicates with the device without an intervening web layer. The application itself can enforce policies before any request reaches the device. For example, it can refuse to sign a transaction that exceeds a spending limit the user set, or that targets an address not in a whitelist, or that would drain an entire wallet in a single operation.

These policies live in the application code, not in the browser. That matters because an attacker who compromises the browser tab cannot simultaneously compromise the native application. They are separate processes. An attacker who controls a webpage cannot intercept USB communication or forge a response from the hardware wallet. The hardware wallet itself can also enforce constraints: Ledger devices run their own firmware and can reject unsigned instructions. Trezor devices store seed phrases in a secure enclave and refuse to export private keys under any circumstances.

The native design also allows applications to use hardware-specific security features. On iOS, a native app can use the Secure Enclave to encrypt sensitive application state. On Android, it can use the Trusted Execution Environment. On macOS and Linux, it can leverage kernel-level isolation and process hardening. A browser has no access to these features. JavaScript running in a browser tab cannot request that the operating system encrypt a variable in a Secure Enclave. It cannot use TPM-backed key storage. It cannot enforce that a particular operation only executes in a specific hardware context.

Why Cake Wallet web documentation emphasizes the native platform architecture

Cake Wallet is distributed as native applications for iOS, Android, macOS, and Linux. The absence of a browser-based version is not a limitation of the development team—it is an intentional architectural decision. The wallet’s support for hardware wallets, including Ledger and Trezor, relies on the same native application model that Ledger and Trezor themselves use. When you import a Ledger seed into Cake Wallet on an iOS device, the application uses the iOS Secure Enclave to protect wallet metadata. When you use a Trezor device with Cake Wallet on Linux, the application communicates with the device through libusb, which is available only to native applications with the appropriate system permissions.

The Cake Wallet source code on GitHub shows this architecture explicitly. The application maintains separate code paths for iOS, Android, macOS, and Linux precisely because each platform offers different hardware integration capabilities and security features. A browser has none of these capabilities. More importantly, a browser is not designed to remain open for the duration of a wallet’s active use. Browsers are designed for stateless, session-based interactions. A cryptocurrency wallet requires persistent state, long-lived connections to blockchain nodes, and the ability to operate without refreshing or navigating away.

The practical consequence is that any cryptocurrency wallet—whether it prioritizes privacy like Cake Wallet or focuses on accessibility—faces a choice: build native applications that can integrate hardware wallets and enforce security policies, or build a web interface that cannot do either. Services that attempt to bridge this gap, such as offering both a web version and a native app, often find that the web version cannot access hardware wallets at all, making it a purely software-based alternative. That trade-off is acceptable for some use cases, but it concedes a significant security advantage to users who use the native version.

The threat model of browser-based cryptocurrency transactions

A user opening a cryptocurrency exchange or wallet interface in a browser faces multiple attack points. The browser itself can be compromised by malware or an exploited vulnerability. The website can be served over an unencrypted connection or with a fraudulent SSL certificate if the attacker controls the network. The user’s machine can have a keystroke logger. Any of these attacks can intercept a private key, seed phrase, or signing request.

Hardware wallets were designed to defend against exactly these scenarios. By requiring that private keys never leave the device, and that all signing operations occur on the device, hardware wallets make an attacker’s job significantly harder. But that defense only works if the attacker cannot see the request before it reaches the device and cannot modify the response before the user sees it. A browser cannot guarantee either of these properties.

Bitcoin’s documentation emphasizes that signing is the critical operation. A user does not need to worry about their private key being stolen if signing only occurs on a hardware device that the user physically controls. But if a browser can display one transaction and cause the device to sign a different transaction, the hardware wallet’s security is compromised. The user approved what they saw, not what they signed.

This is why OWASP’s mobile security guidelines and hardware wallet manufacturers both emphasize native application architecture. A browser cannot enforce hardware isolation. A native application can, and for cryptocurrency use cases—especially when private keys or seed phrases are involved—that difference is decisive.

Monero, Bitcoin, and Litecoin: Why protocol privacy does not substitute for application security

Monero’s privacy architecture protects transaction details from blockchain observers. Monero’s official documentation describes how the protocol uses ring signatures, stealth addresses, and zero-knowledge proofs to hide senders, receivers, and amounts. These are cryptographic properties of the network. They do not protect against a compromised wallet application or a browser-based interface that could leak the seed phrase.

The same principle applies to Bitcoin’s Silent Payments feature, as specified in BIP-352, and Litecoin’s MWEB layer. Both are protocol-level privacy features. Neither one prevents a browser or compromised native application from exfiltrating a seed phrase or signing a transaction the user did not intend. The security of a privacy-focused wallet therefore depends on both layers: the protocol must hide transaction relationships from observers, and the application must prevent attackers from accessing the keys or manipulating signing requests.

Cake Wallet’s support for Monero subaddresses, Bitcoin PayJoin and Silent Payments, Litecoin MWEB, and built-in Tor support all address the protocol layer. The decision to build as a native application addresses the application layer. Neither one is complete without the other. A browser-based Monero wallet using the best privacy features would still leak the user’s IP address through browser-level tracking, could be attacked through a malicious webpage, and could not reliably prevent the private key from being exfiltrated. The protocol privacy is real and important, but it is insufficient when the application itself is compromised.

Direct hardware communication and signed confirmations

A native application can implement a security practice that browsers cannot: displaying a transaction on the screen before signing, ensuring that the user confirms the exact details, and only then sending the signing request to the hardware wallet. This sounds simple, but it requires coordination between three actors: the user interface, the application logic, and the hardware device. If any one of them receives different information, the user might approve one thing while the device signs another.

Native applications can enforce this through process isolation and trusted execution environments. Cake Wallet on iOS, for example, can ensure that a transaction display and the corresponding hardware signing request are issued by the same application instance without any browser process in between. The Ledger device itself, running its own firmware, can validate that the signing request matches what the user should have approved. The operating system can confirm that the USB connection to the hardware wallet is genuine.

A browser cannot enforce any of this. A compromised browser tab can display one address while JavaScript issues a signing request to a different address. The browser cannot confirm that the USB device is genuine or that the signing request came from the same source as the display. An attacker who compromises the webpage can abuse the browser’s WebUSB interface to communicate with the hardware wallet independently of what the user sees on screen.

This is why hardware wallet manufacturers insisted on native application integration. The browser architecture simply does not provide the guarantees that a security-critical operation like hardware wallet signing requires. The user cannot reliably confirm what they are signing.

The persistence problem: Wallets need state, browsers prioritize sessions

A web browser is designed to serve stateless or session-based interactions. A user navigates to a website, performs some action, and leaves. The browser is optimized for this pattern: it can cache data locally, but it assumes that the user might close the tab or clear cookies at any time. That design does not fit a cryptocurrency wallet.

A wallet needs to maintain long-lived connections to blockchain nodes, synchronize transaction history, track balances, and store encrypted sensitive data. These operations are designed to occur in the background while the user is using the device for other purposes. A browser tab cannot do this reliably. If the tab closes or the user navigates away, the synchronization stops. On a mobile device, the browser might be suspended or terminated by the operating system to free memory, interrupting wallet operations.

Native applications, by contrast, can run in the background. They can receive notifications from the operating system. They can synchronize with blockchain nodes using persistent connections. They can request device-level encryption for sensitive keys and metadata. Litecoin’s technical documentation describes how wallets must handle UTXO synchronization and address derivation, operations that require persistent state and reliable background execution.

A browser-based wallet can work for casual use cases—viewing a balance, preparing a transaction, confirming a signature. But it cannot be the primary interface for a wallet that needs to monitor multiple blockchain networks, maintain connection pools, derive addresses across multiple coins, or coordinate with hardware devices. Cake Wallet’s native architecture across iOS, Android, macOS, and Linux reflects this requirement. The application needs to remain operational and responsive regardless of what else the user is doing with their device.

Practical security implications for users choosing a wallet

For a user deciding whether to use a browser-based cryptocurrency service or a native wallet application, the distinction is not purely theoretical. If the service offers hardware wallet support, that is a strong signal that it uses a native application. If it claims to offer hardware wallet support through a web interface, that claim should be treated with significant skepticism. The security properties do not add up.

The same principle applies to other security features. If an application claims to use Tor for network privacy, as Cake Wallet does experimentally, a native application can ensure that all traffic actually routes through Tor, whereas a browser cannot guarantee this without relying on a browser extension that has its own security issues. If an application supports multiple seed types—Polyseed, 25-word Monero seeds, or BIP-39 phrases—a native application can verify the seed locally using the correct derivation standard, whereas a web interface would need to transmit the seed or at least derive keys on a server.

The decision to use a native application is essentially a decision to trust the application developer and the operating system. The decision to use a browser interface is a decision to trust the browser vendor, the operating system, the website’s server, the network connection, and every JavaScript library loaded by that webpage. Both models involve trust, but they do not trust the same actors.