A group of privacy enthusiasts discovered on Tuesday that the default software development kit (SDK) that wallet apps use to connect to Ledger hardware devices transmits details regarding crypto transaction signatures to Ledger servers.
When the discovery spread on social media, privacy proponents were surprised to discover that Ledger crypto wallet apps have been quietly broadcasting transaction details to Ledger.
The behavior has been a default since Ledger’s context-module version 1.16, i.e. since May 2026 or earlier.
It was a devastating discovery for users who have mistakenly thought the default behavior of Ledger wallets was private signing and private broadcasts of transactions directly to blockchain networks.
Unfortunately, many Ledger wallets have been simultaneously doxxing personal details to the world’s largest hardware wallet manufacturer.
Substantial metadata has been transmitting from Ledger devices to Ledger servers since late May. Apps and users must opt-out of this information-sharing behavior when using wallet apps, and the overwhelming majority do not.
Ambire developer Kaloyan Kosev (also known as “superKalo”) flagged the issue yesterday: Ledger servers have been receiving customers’ Ledger model, software version, as well as blockchain address users paid or queried.
Ledger SDK not private by default
The problem, in addition to poor disclosure about this default behavior, included non-blind-signing.api.ledger.com, an endpoint the software kit’s builder sets by default.
Despite the name, the very non-bling-signing, Ethereum-based signer fires a report on every transaction and typed-data signing request, whether the user requests to sign blind or not.
Kosev wrote, “I’d argue that privacy should be the default,” especially for a company like Ledger.
Ledger developers committed the original data reporter on March 26, and Ledger’s context-module version 1.16.0 added it to the live package in April, which then disseminated to Ledger users in April and May.
That release aimed data-sharing at a Ledger staging server, and version 2.1.0 switched them on to production.
Read more: ‘Decentralized’ apps suffer after Ledger Connect Kit attack
Ledger responds to criticisms by privacy advocates
Ledger Donjon, the company’s in-house security team, replied, “This is part of how clear signing works” on Tuesday.
So-called “clear signing descriptors,” which turn raw transactions into readable text, are too big for a device, Donjon said, so the SDK looks them up on Ledger’s servers for better performance.
Donjon added, “That requires sending the transaction details needed to find the right descriptor.”
Ledger’s security team has sworn that Ledger keeps none of the data, and that wallets can plug in their own module if they want to avoid this default information-sharing behavior.
The company’s co-founder Nicolas Bacca, who left in 2023, told Bitcoin enthusiast Mr Hodl that it might have been a default that was “overlooked.”
Mr Hodl asked, “Nobody opted in. Why was it opt out?” Bacca admitted that he had no idea why.
Ledger’s own wallet app routes other data through Ledger as well. Its Bitcoin module, for example, reads account history and fee rates from a Ledger explorer, and broadcasts transactions to it.
The app queries that explorer address by address and posts each signed transaction to its send endpoint.
In 2023, Protos reported that Ledger Live sent clicks, account counts, crypto asset names, device type and firmware to analytics firm Segment. Ledger now says its personalization trackers need opt-in consent.
Separately, Ledger’s 2020 data breach exposed the names, addresses and phone numbers of about 272,000 customers.
Last month, spyware in devices sold by an ostensibly official yet unreliable Ledger reseller in Malaysia drained more than $86 million from vicitms.
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.
The post Ledger’s SDK snitched users’ transaction data and device info appeared first on Protos.
