Ledger signing kit transmits transaction and device metadata by default, sparking privacy concerns
Ledger's developer kit for wallet applications transmits signature details, device specs, and destination addresses back to Ledger servers by default, an Ambire developer revealed.
Ledger's software development kit (SDK), used by crypto wallet applications to connect with Ledger hardware, reports transaction signature data to company servers by default unless apps explicitly opt out, Ambire developer Kaloyan Kosev revealed on Nov. 10. The transmitted details include network and destination addresses, device model and firmware version, active software versions, and an indicator of whether the user signed blindly without seeing human-readable transaction terms.[1][3]
The reporting functionality originated in version 1.16 of Ledger's context-module package, initially pointing to a staging address before moving to production under non-blind-signing.api.ledger.com in version 2.1.0. A Ledger engineer merged an update titled "Turn multichain sign reporter on" on Oct. 8, broadening the reporting across Ethereum and Solana. Ambire disabled the default behavior in its own pull request merged Sept. 30, preventing the code from entering its production releases.[1][2][3]
Ledger Donjon, the company's security research unit, defended the architecture as a core component of its Clear Signing system. Donjon explained that ERC-7730 descriptor files needed to display transaction terms in plain language are too large to store on hardware devices, requiring the SDK to fetch matching descriptors from Ledger's servers by passing necessary transaction details. Donjon maintained that Ledger does not retain this data and pointed out that third-party wallet developers can replace the default module.[1][3]
Both Ledger Donjon and SlowMist's Yu Xian clarified that the data transmission occurs within the software SDK rather than the hardware device's firmware. However, critics voiced strong concerns. Commentator @gregthegreek noted that post-signing API requests still allow addresses to be correlated to users, calling the calls "completely unnecessary" and highlighting that telemetry transmits even during failed signing attempts. Former Ledger co-founder Nicolas Bacca suggested the opt-out mechanism may have been an overlooked default.[1][3][4][5]
Key facts
- Ambire developer Kaloyan Kosev reported on Nov. 10 that Ledger's SDK sends transaction signature details to Ledger servers by default unless apps opt out.
- Transmitted metadata includes the destination address, network, device identification, firmware version, app versions, and whether blind signing was used.
- The reporting code was introduced in version 1.16.0 of Ledger's context-module package and switched to production servers in version 2.1.0.
- A Ledger engineer merged a pull request titled 'Turn multichain sign reporter on' on Oct. 8, covering Ethereum and Solana signing events.
- Ledger Donjon stated the server lookups are necessary for Clear Signing because ERC-7730 descriptor files are too large for the physical devices, adding that Ledger does not store the transmitted data.
- Ledger Donjon and SlowMist's Yu Xian confirmed that the reporting code resides in the SDK, not in the hardware device firmware.
- Former Ledger co-founder Nicolas Bacca stated that having the reporting enabled by default may have been 'overlooked.'
Sources · 3 sources
- UN
UnchainedArticle ·
Ledger’s Developer Kit Reports Every Signature to Ledger Unless Wallets Opt Out, Ambire Developer Says A developer at rival wallet maker Ambire said on Nov. 10 that Ledger’s signing kit, the software development kit (SDK) that wallet apps use to talk to Ledger hardware devices, sends details of every signature back to Ledger by default. The developer, Kaloyan Kosev, wrote that each signature pings a Ledger server. The report names the network and the destination address, identifies the device and its firmware, lists the app versions in use and flags if the user approved the transaction blind. Blind signing means approving a transaction the device can’t show in readable form. He said the reporting has been on by default since version 1.16 of Ledger’s context-module package. “I’d argue that privacy should be the default,” he wrote. Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter . The Code Predates the Post Ledger’s public changelog for the package lists a “blind signing reporter” added in version 1.16.0, then pointed at a production address, blind-signing.api.ledger.com, in version 2.1.0. A Ledger engineer merged a change on Oct. 8 titled “Turn multichain sign reporter on,” which posts signing events for Ethereum and Solana. Ambire knew earlier still. Kosev opened a pull request on Sept. 24 that keeps the reports off unless a user turns them on, and Ambire merged it Sept. 30. He said none of the affected releases made it into Ambire’s live app. Ledger’s Response Ledger Donjon , the company’s security research team, replied on X that “this is part of how Clear Signing works.” Clear Signing is Ledger’s system for showing transactions on the device in plain terms, using descriptor files written to an Ethereum standard called ERC-7730. Donjon said those files are too big to keep on the device, so the default module looks them up on Ledger’s servers when a user signs, which means passing along enough of the transaction to find the match. It said Ledger does not keep that data, and that wallet makers can swap in their own module. Some reactions put the code in the wrong place. Lefteris Karapetsas asked on X whether Ledger “devices with the latest ledger firmware are phoning home” and handing Ledger a record of every signature. Donjon and Yu Xian of security firm SlowMist, who posts as Cos , both said the code runs in the SDK, not in firmware. The scrutiny comes a month after Ledger devices sold through a Southeast Asian reseller were drained in a separate attack. Related Listen: Why a $100M Ledger Reseller Attack Has Crypto Rethinking Self-Custody The post Ledger’s Developer Kit Reports Every Signature to Ledger Unless Wallets Opt Out, Ambire Developer Says appeared first on Unchained .
Open source - LS
Laura Shin@laurashinPost on X ·
Ledger merged code switching on its multichain sign reporter on Oct. 8, about a month before Ambire developer Kaloyan Kosev raised the alarm on X. Ledger Donjon says the server lookups are what make Clear Signing possible. https://t.co/ukqAlNO2AW
Open source - PR
ProtosArticle ·
Ledger’s SDK snitched users’ transaction data and device info A group of privacy enthusiasts discovered on Tuesday that the default software development kit (SDK) that wallet apps use to connect to Ledger hardware devices transmits details regarding crypto transaction signatures to Ledger servers. When the discovery spread on social media, privacy proponents were surprised to discover that Ledger crypto wallet apps have been quietly broadcasting transaction details to Ledger. The behavior has been a default since Ledger’s context-module version 1.16, i.e. since May 2026 or earlier. It was a devastating discovery for users who have mistakenly thought the default behavior of Ledger wallets was private signing and private broadcasts of transactions directly to blockchain networks. Unfortunately, many Ledger wallets have been simultaneously doxxing personal details to the world’s largest hardware wallet manufacturer. Substantial metadata has been transmitting from Ledger devices to Ledger servers since late May. Apps and users must opt-out of this information-sharing behavior when using wallet apps, and the overwhelming majority do not. Ambire developer Kaloyan Kosev (also known as “superKalo”) flagged the issue yesterday: Ledger servers have been receiving customers’ Ledger model, software version, as well as blockchain address users paid or queried. If your wallet of choice isn’t @ambire and it runs Ledger’s latest signing kit, chances are every signature you make gets reported back to Ledger. I noticed it early while bumping Ledger packages to debug an issue! No affected version ever reached Аmbire production, and we’re… pic.twitter.com/wiyounyPQ5 — superKalo.eth (@0xSuperKalo) November 10, 2026 Ledger SDK not private by default The problem, in addition to poor disclosure about this default behavior, included non-blind-signing.api.ledger.com, an endpoint the software kit’s builder sets by default. Despite the name, the very non-bling-signing, Ethereum-based signer fires a report on every transaction and typed-data signing request, whether the user requests to sign blind or not. Kosev wrote , “I’d argue that privacy should be the default,” especially for a company like Ledger. Ledger developers committed the original data reporter on March 26, and Ledger’s context-module version 1.16.0 added it to the live package in April, which then disseminated to Ledger users in April and May. That release aimed data-sharing at a Ledger staging server, and version 2.1.0 switched them on to production. Ledger spyware scare spreads beyond Southeast Asia Read more: ‘Decentralized’ apps suffer after Ledger Connect Kit attack Ledger responds to criticisms by privacy advocates Ledger Donjon, the company’s in-house security team, replied , “This is part of how clear signing works” on Tuesday. So-called “clear signing descriptors,” which turn raw transactions into readable text, are too big for a device, Donjon said, so the SDK looks them up on Ledger’s servers for better performance. Donjon added , “That requires sending the transaction details needed to find the right descriptor.” Ledger’s security team has sworn that Ledger keeps none of the data, and that wallets can plug in their own module if they want to avoid this default information-sharing behavior. The company’s co-founder Nicolas Bacca, who left in 2023, told Bitcoin enthusiast Mr Hodl that it might have been a default that was “overlooked.” Mr Hodl asked , “Nobody opted in. Why was it opt out?” Bacca admitted that he had no idea why. Ledger’s own wallet app routes other data through Ledger as well. Its Bitcoin module, for example, reads account history and fee rates from a Ledger explorer, and broadcasts transactions to it. The app que r ies that explorer address by address and posts each signed transaction to its send endpoint. In 2023, Protos reported that Ledger Live sent clicks, account counts, crypto asset names, device type and firmware to analytics firm Segment. Ledger now says its personalization trackers need opt-in consent. Separately, Ledger’s 2020 data breach exposed the names, addresses and phone numbers of about 272,000 customers. Last month, spyware in devices sold by an ostensibly official yet unreliable Ledger reseller in Malaysia drained more than $86 million from vicitms. Got a tip? Send us an email securely via Protos Leaks . For more informed news and investigations, follow us on X , Bluesky , and Google News , or subscribe to our YouTube channel. The post Ledger’s SDK snitched users’ transaction data and device info appeared first on Protos .
Open source - LS
Laura Shin@laurashinPost on X ·
"There's a post request, an API recall to their server after a signing interaction happens containing metadata, there's a v1 versus a v2. They strip some of the metadata out of the v2 but you can still correlate an address to a user and it happens after signing, which is completely unnecessary," @gregthegreek on the Ledger signing debacle https://t.co/INrbsCZyfM⁶
Open source - LS
Laura Shin@laurashinPost on X ·
"Even if it fails, even if there's like an error, they still send telemetry," @gregthegreek on the Ledger signing drama https://t.co/9FRmwKiOwO
Open source