How to Migrate Your Ledger Key to a Hardened Derivation Path

TL;DR

Ledger's newest firmware enforces a new standard for generating public keys called hardened derivation paths. On July 16 2026, Casa released support for hardened derivation paths with iOS version 5.19.0 and Android version 5.19.0.
To align with Ledger's current standard and use the latest Bitcoin app, a migration to a new vault is required.
Migrating follows the same process as a key rotation: your old Ledger key is replaced with a new one derived from a hardened path, a new vault is created with your updated keyset, and your funds are transferred to it.
Once complete, you can use the standard Ledger Bitcoin app for all signing — no Recovery app needed.
This migration is optional. Your vault is secure and your Bitcoin is not at risk today.

Why Migrate

Although optional, migrating your Ledger key to a hardened path is recommended if you want to:

Use the standard Ledger Bitcoin app (rather than the Bitcoin Recovery app) going forward.
Align with Ledger's current derivation standard.
Future-proof your vault against potential Ledger firmware enforcement.

Before You Begin

Update Your Bitcoin App Version

Before starting, confirm your firmware and app versions in Ledger Wallet (formerly Ledger Live) under My Ledger.

My Bitcoin App Version	What to do
2.4.2 or lower	Update to 2.4.3+ before migrating
2.4.3 or higher	Ready to migrate
Bitcoin Recovery App 2.4.5	Ready to migrate

For full details on checking your version and what to do if you're on an incompatible version, see: Ledger Bitcoin App and Firmware Guide

What Happens During Migration

Your Ledger exports a new xPub — this time derived from a hardened path
That new xPub is used to create a new vault with your updated keyset
Your funds are transferred from your old vault to the new one
Your old Ledger key is retired; the new hardened key takes its place in the new vault

Your seed phrase does not change. Your signing threshold, number of keys, and overall security setup remain the same. Only the derivation path used by your Ledger key changes, and your funds move to a new vault that reflects that updated keyset.

Note: If you have whitelisted your Casa vault address at an exchange or elsewhere, you will need to update it to an address from your new vault after the migration is complete.

Steps to Migrate

Perform a health check on all remaining keys in your vault. Confirm you have a working quorum of keys.
1. See: Performing a health check with Ledger
Confirm your Ledger has standard Bitcoin app 2.4.3 or higher installed.
1. In Ledger Wallet, go to My Ledger.
2. Find Bitcoin or Bitcoin Recovery in your installed apps.
3. Note the version number listed next to the app name — 2.4.3 or higher
Mark your Ledger key for replacement in the Casa app.
1. Tap on your vault
2. Tap the key icon in the top-right corner
3. Tap the key you want to replace (whichever is your Leger)
4. Tap Replace Key
5. Read the explanation, then tap Yes, Confirm
Set up the new key by connecting your Ledger using the most up-to-date Bitcoin app.
1. Tap Begin Replacement Process
2. Select Ledger and tap Continue
3. Read the on-screen instructions, then tap Continue to send yourself the setup email
4. Click the link in the email on your computer and follow the instructions to connect your device
Transfer your funds to the new vault by signing a recovery transaction using the old Bitcoin Recovery app.
1. See: Perform a guided recovery

Important: 3-key vault members! You will need to use the Bitcoin Recovery app to sign the fund transfer with your Ledger from your old vault to the new one. Once the transfer is complete and your new vault is set up with the hardened key, you can return to using the standard Bitcoin app for all future signing. If you have questions about this step, contact our support team through the Help tab in your Casa app before proceeding.

For complete step-by-step instructions, see: Key Rotation: Replacing a Key in the Casa App

After Migration

You can use the standard Ledger Bitcoin app for all future signing — no Recovery app needed
Your new vault functions exactly like your old one, with the same threshold and keyset structure
Other keys in your vault (Trezor, mobile key, Casa key, etc.) are unaffected — they do not need to rotate at the same time
If you have a whitelisted deposit address at an exchange, update it to an address from your new vault

What If I Don't Want to Migrate to Ledger's Newest Standard?

Migration is optional. If you'd prefer to keep your existing vault as-is, you have two alternatives:

Option 1: Continue using your Ledger with the Bitcoin Recovery app You can continue using your existing Ledger device and vault without any changes. When signing transactions, you will need to use the Ledger Bitcoin Recovery app instead of the standard Bitcoin app. Your vault remains fully secure and functional — this is purely a workflow consideration.
Option 2: Import your seed phrase onto a different hardware device If you have access to your seed phrase, you can import it onto a different hardware device — a Trezor, for example — and use that as your signing device going forward. Because the seed phrase is the same, the key itself is unchanged, no new vault is created, and no fund transfer is required. Your vault continues to function exactly as it does today.

Frequently Asked Questions

Do I need to move my Bitcoin manually? No. The fund transfer is part of the key rotation flow in the Casa app. The app will guide you through signing a transaction that moves your funds from the old vault to the new one. See how to perform a guided recovery ->

Can I still use my Ledger if I haven't migrated? Yes. If your Ledger is on an older firmware or Bitcoin app version, you can continue signing with the Bitcoin Recovery app. How to Use the Bitcoin Recovery App

What if I have multiple Ledger devices in my vault? You'll need to rotate each one separately. You can do them in any order, or space them out over time. Each rotation will create a new vault and require you to recover your funds each time.

What about inheritance? Will my recipient's cloned Ledger still work? If your inheritance recipient has a cloned Ledger (same seed phrase, different device), they will be able to sign using that device after migration — as long as their device and app version support the hardened derivation path. If they're on older firmware, they may need to use the Bitcoin Recovery app for signing. We recommend reviewing your inheritance setup with our team if you have any questions.

Questions?

If you'd like help reviewing your vault setup before migrating, or if you run into any issues during the process, reach out through the Help tab in your Casa app or email help@team.casa.

Additional Resources