Key Highlights
- Ledger’s latest signing kit reportedly sends wallet model, software version and queried or paid blockchain addresses to Ledger servers by default.
- Ambire developer Kaloyan Kosev identified the reporting behavior, which affects transaction and typed-data signing requests unless wallet apps opt out or use their own module.
- Ledger says the data supports clear-signing descriptors and insists it does not retain the information, while privacy advocates have questioned why sharing is opt-out rather than opt-in.
Ledger Wallet Signing Kit Raises Privacy Concerns
Ledger users who assumed their hardware wallets privately signed and privately broadcast transactions directly to blockchain networks have faced a significant privacy disclosure. Substantial metadata has reportedly been transmitted from Ledger devices to Ledger servers since late May, including the Ledger model, software version and blockchain addresses that users paid or queried.
Wallet applications and users must opt out of the information-sharing behavior, but the source says the overwhelming majority do not. The issue was flagged by Kaloyan Kosev, an Ambire developer also known as “superKalo,” who reported that Ledger servers had been receiving information connected to customers’ signing activity.
If your wallet of choice isn’t @ambire and it runs Ledger’s latest signing kit, chances are every signature you make gets reported back to Ledger.I noticed it early while bumping Ledger packages to debug an issue! No affected version ever reached Аmbire production, and we’re…
— superKalo.eth (@0xSuperKalo), November 10, 2026
How Ledger’s Default Reporting Works
The reported behavior is linked to the non-blind-signing.api.ledger.com endpoint, which the signing kit sets as its default. Despite its name, the Ethereum-based signer reportedly sends a report for every transaction and typed-data signing request, regardless of whether a user is signing blindly.
Kosev wrote, “I’d argue that privacy should be the default,” especially for a company like Ledger. According to the source, Ledger developers committed the original data reporter on March 26. Ledger’s context-module version 1.16.0 then added the functionality to the live package in April, with the package reaching Ledger users during April and May.
Ledger’s Explanation and Privacy Response
Ledger Donjon, Ledger’s in-house security team, addressed the criticism from privacy advocates on Tuesday. The team replied, “This is part of how clear signing works”.
Ledger said so-called “clear signing descriptors” convert raw transactions into readable text but are too large to store on a hardware device. The software development kit therefore retrieves those descriptors from Ledger servers to improve performance. Donjon added, “That requires sending the transaction details needed to find the right descriptor.”
Ledger’s security team said the company does not retain the transmitted data and that wallet developers can connect their applications to a different module if they want to avoid the default information-sharing behavior. The company’s co-founder Nicolas Bacca, who left Ledger in 2023, told Bitcoin enthusiast Mr Hodl that the setting may have been “overlooked.” When Mr Hodl asked, “Nobody opted in. Why was it opt out?” Bacca admitted that he did not know.
Other Ledger Data-Sharing and Security Issues
The source also points to data flows through Ledger’s own wallet application. Ledger Live’s Bitcoin module reads account history and fee rates from a Ledger explorer and broadcasts transactions to that service. The application queries the explorer address by address and posts each signed transaction to its send endpoint.
Protos reported in 2023 that Ledger Live sent clicks, account counts, crypto asset names, device types and firmware information to the analytics company Segment. Ledger now says its personalization trackers require opt-in consent.
The latest disclosure follows Ledger’s 2020 data breach, which exposed the names, addresses and phone numbers of about 272,000 customers. Separately, spyware found in devices sold by an ostensibly official but unreliable Ledger reseller in Malaysia drained more than $86 million from victims last month.
Why This Matters
Hardware wallets are commonly used to keep private keys away from internet-connected systems, but signing privacy also depends on the software and services connected to the device. If transaction details, wallet addresses or signing metadata are sent to a manufacturer by default, users may have less privacy than they expect even when their private keys remain on the hardware wallet.
The dispute also places greater importance on default settings and disclosure. Ledger says the reporting supports clear signing and that developers can replace the relevant module, while critics argue that users should actively consent before transaction-related data leaves their wallet environment. Wallet developers using Ledger’s latest signing kit may now need to review their integrations and decide whether to retain or remove the default reporting behavior.
Frequently Asked Questions
What information was reportedly sent to Ledger?
The reported metadata includes a user’s Ledger model, software version and blockchain addresses that the user paid or queried. The signing kit was also described as reporting transaction and typed-data signing requests.
Why does Ledger say the data is transmitted?
Ledger says its servers provide clear-signing descriptors that convert raw transactions into readable text. According to Ledger Donjon, the descriptors are too large for the device, so the SDK retrieves them from Ledger servers.
Can wallet developers avoid the default behavior?
Ledger says wallets can use their own module instead of the default module. The source says applications and users must opt out of the information-sharing behavior, while Ambire reported that no affected version of its software reached production.
