Ledger SDK sent users’ transaction data to company servers

Ledger’s default hardware-wallet SDK has sent device models, software versions, blockchain addresses and signing requests to company servers no later than May 2026, according to Protos and Ambire developer Kaloyan Kosev.

A group of privacy enthusiasts discovered the behavior on Tuesday. The finding spread on social media, where proponents said they had expected wallet apps to keep transaction details private. Kosev, also known as “superKalo,” had flagged the issue a day earlier. Apps and users must opt out of reporting. Protos said the overwhelming majority do not.

The report also highlighted poor disclosure. The SDK defaults to the non-blind-signing.api.ledger.com endpoint, which records every transaction and typed-data signing request, even when a user asks to sign blindly. Kosev identified the Ledger model, software version, and blockchain addresses that users paid to or queried.

Protos traced the default to Ledger’s context-module version 1.16, which it said had applied since May 2026 or earlier. Ledger developers committed the original data reporter on March 26. Version 1.16.0 added it to the live package in April, then reached users in April and May.

Why Ledger says the data transfer exists

Ledger Donjon, the company’s in-house security team, said: “This is part of how clear signing works.” Clear-signing descriptors turn raw transactions into readable text, but Donjon said they are too large for the device.

The SDK retrieves them from Ledger servers to improve performance, which requires sending the transaction details needed to identify the correct descriptor.

Donjon said Ledger keeps none of the data. Wallet developers can plug in their own module to avoid the default information-sharing behavior. Kosev challenged the design choice, saying: “I’d argue that privacy should be the default,” particularly for Ledger.

Former co-founder Nicolas Bacca, who left in 2023, told Bitcoin enthusiast Mr Hodl that the default may have been overlooked. When Mr Hodl asked why it was opt-out and why nobody had opted in, Bacca said he had no idea.

What does this change for wallet users?

The finding concerns metadata and server dependence, not a reported theft of private keys. The SDK can sign on the device while its reporter sends device identity, address and request details to Ledger.

Ledger’s own wallet app adds another route. Its Bitcoin module reads account history and fee rates from Ledger Explorer. It queries that service address by address and posts each signed transaction to the explorer’s send endpoint.

The practical question is which party receives the data required to complete a signing request. Users who expected private signing and direct blockchain broadcasts must opt out of the SDK reporter or use a replacement module. Ledger Live users also rely on Ledger’s explorer for account data and transaction delivery.

The wider privacy record

Protos also cited Ledger Live’s 2023 disclosure to analytics firm Segment. At the time, the app sent clicks, account counts, crypto asset names, device type and firmware. Ledger now says its personalization trackers require opt-in consent.

Earlier, a 2020 Ledger data breach exposed the names, addresses and phone numbers of about 272,000 customers. Last month, spyware on devices sold by an ostensibly official yet unreliable Ledger reseller in Malaysia drained more than $86 million from victims. Protos reported that incident separately from the SDK behavior.

That does not link the malware to Ledger’s reporting servers. It does place the SDK disclosure beside a longer record of data concentration, analytics and reseller risks around hardware wallets.

Without a stated remediation deadline, the next SDK release is the point at users can judge whether the default changes. Until then, the default connection to Ledger servers remains part of the signing process, even for users who never chose it.