Ledger SDK 1.16.0 Defaults to Signing-Metadata Reports

By Nathan Brooks

Ledger’s version 1.16.0 wallet-integration code installs a network reporter by default, sending signing metadata to Ledger servers unless the integrating developer supplies a replacement, according to Ledger’s public source code.

The behavior, highlighted on Nov. 10 by Ambire developer @0xSuperKalo, sits in the software layer that wallet applications use to communicate with Ledger hardware. It is not a firmware-only issue, and the affected exposure depends on each wallet’s integration.

Ledger’s public source code shows that reports can include the network, destination address, device model, software versions, and whether signing was blind. The available report therefore can carry both transaction-routing information and details about the signing environment. The source does not specify that every field is transmitted in every report or that a particular wallet has exposed user data.

What does version 1.16.0 change?

In the 1.16.0 implementation, the network reporter is installed unless the integrating developer provides a replacement. That makes the wallet application’s configuration the control point. A hardware firmware update alone would not establish whether the application has replaced the default reporter or retained it.

For wallet teams, this shifts the privacy review from the device to the integration code, including how an SDK version is selected and how its reporter is configured.

For users, it means that the relevant setting may reside in the connected wallet application rather than on the Ledger device itself. The practical question is not merely whether the hardware runs updated software; it is whether the wallet sends signing metadata through Ledger’s reporting service.

That distinction also limits how the finding applies across the market. Ledger’s SDK serves as one integration point for applications using the hardware, but the account does not identify other wallet providers, say they ship version 1.16.0, or describe their reporting settings.

The verified conclusion is narrower: the default reporter exists in the cited implementation, and its use depends on the integrating application.

Is Ambire exposed in production?

No affected version had reached Ambire’s production application, @0xSuperKalo said. Ambire was shipping reporting disabled by default and provided an opt-in toggle in its privacy settings. The developer wrote: “I'd argue that privacy should be the default.”

That configuration gives Ambire users a way to keep the reporting service off unless they activate it. It also means Ambire is not presenting the SDK default as the production setting for its application. The developer’s statement establishes Ambire’s deployment status on Nov. 10, rather than a guarantee about other applications using Ledger hardware.

The distinction matters because the default and the deployment are separate events. The SDK can install a reporter by default; an application can still ship with reporting disabled; and users can still control the setting if the application exposes it.

Ambire’s approach addresses both the initial configuration and the user-facing choice, while the cited implementation leaves replacement of the network reporter to the integrating developer.

What does this change for wallet users and teams?

The established fact is narrow: version 1.16.0 installs a network reporter by default unless a developer provides a replacement, and reports can include transaction and device fields. Exposure therefore requires the wallet application and its configuration, not the hardware model alone.

For practitioners, the review target is the SDK version and reporter configuration used by each wallet. Integrators need to determine whether they supply a replacement, disable the default path, or require explicit user consent. Users should check privacy controls in the wallet application they use. A firmware update alone does not answer the operational question.

The next material checkpoint is integration-level: as wallet teams select or update Ledger integrations, their choice of replacement reporter and consent controls will determine whether signing metadata reaches Ledger servers.