A code review found that Ledger's software development kit (SDK) sends signing information and transaction metadata to Ledger servers. Privacy enthusiasts discovered the behavior on Tuesday in the default SDK that wallet apps use to connect with Ledger hardware devices. The discovery surprised privacy advocates when the findings circulated on social media.
The sharing has been enabled by default since context-module version 1.16, dating to May 2026 or earlier. Substantial metadata has flowed from Ledger devices to Ledger servers since late May. Apps and users must opt out of the sharing, but the overwhelming majority do not. Many users had mistakenly believed Ledger wallets signed transactions privately and broadcast transactions directly to blockchain networks without also sharing personal details with Ledger.
Ambire developer Kaloyan Kosev, also known as superKalo, flagged the issue yesterday. Kosev said Ledger servers received customers' device models, software versions and blockchain addresses that users paid or queried. Kosev argued that privacy should be enabled by default, particularly at Ledger.
The SDK builder selects a Ledger server endpoint by default, and disclosure of that behavior was inadequate. The Ethereum-based signer sends a report for every transaction-signing and typed-data-signing request, regardless of whether the user requests blind signing.
Ledger developers committed the original reporting code on March 26. Context-module version 1.16.0 incorporated the code into the live package in April, with distribution to users during April and May. The initial release directed the shared data to a Ledger staging server. Version 2.1.0 changed the destination to production servers.
Ledger Donjon, Ledger's internal security team, said on Tuesday that the transfers form part of clear signing. Donjon said clear signing descriptors convert raw transactions into readable text but are too large for a device. Donjon said the SDK retrieves the descriptors from Ledger servers to improve performance. Donjon said finding the appropriate descriptor requires transmitting the relevant transaction details. Ledger's security team said Ledger retains none of the data. The security team said wallets can use their own module to avoid the default sharing.
Ledger co-founder Nicolas Bacca, who left in 2023, told Bitcoin enthusiast Mr Hodl that the default setting might have been overlooked. Mr Hodl questioned why the sharing required users to opt out when nobody had opted in. Bacca said Bacca did not know why.
Ledger's wallet app also sends other information through Ledger infrastructure. The app's Bitcoin module obtains account histories and fee rates from a Ledger explorer and broadcasts transactions through that explorer. The app checks the explorer separately for each address and submits every signed transaction to the explorer's send endpoint.
Ledger Live sent analytics firm Segment information about clicks, account counts, crypto asset names, device types and firmware, according to reporting published in 2023. Ledger now says personalization trackers require opt-in consent. A separate data breach in 2020 exposed names, addresses and phone numbers belonging to about 272,000 Ledger customers. Last month, spyware in devices sold by an ostensibly official but unreliable Ledger reseller in Malaysia drained more than $86 million from victims.