Ledger SDK quietly sends transaction data to company servers

On Tuesday, a group focused on privacy discovered that the default SDK wallet apps use to connect with Ledger hardware sends information about crypto transaction signatures to Ledger's servers.

As word of the finding spread across social media, those concerned with privacy were taken aback to learn that Ledger crypto wallet apps had been silently forwarding transaction details to the firm.

This has been the standard behavior since Ledger's context-module version 1.16, which dates back to May 2026 or earlier.

For users who believed Ledger wallets handled signing and broadcasting transactions directly to blockchain networks in private by default, the revelation was a shock.

Many Ledger wallets have been simultaneously disclosing personal data to the biggest hardware wallet manufacturer globally, as noted in a related report.

Since late May, a significant amount of metadata has been flowing from Ledger devices to Ledger servers. Wallet apps and their users have to manually opt out of sharing this information, something the vast majority fail to do.

Ambire developer Kaloyan Kosev, also known as "superKalo," highlighted the issue yesterday: Ledger servers have been receiving customers' Ledger model, software version, and the blockchain addresses users paid or looked up.

If your wallet of choice isn't @ambire and it runs Ledger's latest signing kit, chances are every signature you make gets reported back to Ledger.

I noticed it early while bumping Ledger packages to debug an issue! No affected version ever reached Аmbire production, and we're… pic.twitter.com/wiyounyPQ5

— superKalo.eth (@0xSuperKalo) November 10, 2026

Ledger SDK not private by default

Beyond the lack of proper communication about this standard behavior, the issue also included the endpoint non-blind-signing.api.ledger.com, which the software kit's builder sets as default.

Despite what the name suggests, the non-blind-signing Ethereum-based signer sends a report for every transaction and typed-data signing request, whether the user opts for blind signing or not.

Kosev stated, "I'd argue that privacy should be the default," especially for a company like Ledger.

The original data reporter was committed by Ledger developers on March 26, and it was added to the live package in Ledger's context-module version 1.16.0 in April, which then spread to Ledger users in April and May.

That release initially aimed data-sharing at a Ledger staging server, while version 2.1.0 shifted them to production.

Ledger responds to criticisms by privacy advocates

Ledger Donjon, the firm's internal security unit, responded on Tuesday, "This is part of how clear signing works".

Donjon explained that so-called "clear signing descriptors," which convert raw transactions into readable text, are too large for a device, so the SDK retrieves them from Ledger's servers for improved performance.

Donjon added, "That requires sending the transaction details needed to find the right descriptor."

Ledger's security team has assured that Ledger retains none of the data, and that wallets can implement their own module if they wish to avoid this standard data-sharing practice.

Nicolas Bacca, who left the company in 2023, told Bitcoin enthusiast Mr Hodl that it might have been a default that was "overlooked."

Mr Hodl asked, "Nobody opted in. Why was it opt out?" Bacca admitted that he had no idea why.

Ledger's own wallet app also routes other data through Ledger. Its Bitcoin module, for instance, reads account history and fee rates from a Ledger explorer, and broadcasts transactions to it.

The app queries that explorer address by address and posts each signed transaction to its send endpoint.

In 2023, Protos reported that Ledger Live sent clicks, account counts, crypto asset names, device type and firmware to analytics firm Segment. Ledger now says its personalization trackers require opt-in consent.

Separately, a 2020 data breach at Ledger exposed the names, addresses and phone numbers of approximately 272,000 customers.

Last month, spyware in devices sold by a seemingly official but unreliable Ledger reseller in Malaysia drained more than $86 million from victims.