CONNECT WITH US
Web3 & Blockchain

Web3 & Blockchain

Ledger’s SDK snitched users’ transaction data and device info

Protos logo

Published on

Add as a preferred source on Google
Ledger’s SDK snitched users’ transaction data and device info

A group of privacy enthusiasts discovered on Tuesday that the default software development kit (SDK) that wallet apps use to connect to Ledger hardware devices transmits details regarding crypto transaction signatures to Ledger servers.

When the discovery spread on social media, privacy proponents were surprised to discover that Ledger crypto wallet apps have been quietly broadcasting transaction details to Ledger.

The behavior has been a default since Ledger’s context-module version 1.16, i.e. since May 2026 or earlier.

It was a devastating discovery for users who have mistakenly thought the default behavior of Ledger wallets was private signing and private broadcasts of transactions directly to blockchain networks.

Unfortunately, many Ledger wallets have been simultaneously doxxing personal details to the world’s largest hardware wallet manufacturer.

Substantial metadata has been transmitting from Ledger devices to Ledger servers since late May. Apps and users must opt-out of this information-sharing behavior when using wallet apps, and the overwhelming majority do not.

Ambire developer Kaloyan Kosev (also known as “superKalo”) flagged the issue yesterday: Ledger servers have been receiving customers’ Ledger model, software version, as well as blockchain address users paid or queried.

If your wallet of choice isn’t @ambire and it runs Ledger’s latest signing kit, chances are every signature you make gets reported back to Ledger.

I noticed it early while bumping Ledger packages to debug an issue! No affected version ever reached Аmbire production, and we’re… pic.twitter.com/wiyounyPQ5

com, an endpoint the software kit’s builder sets by default.



Source link
Related Topics:Web3 & Blockchain

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.