Kaloyan Kosev, an Ambire developer, revealed on November 10 that the default software development kit for Ledger hardware wallets transmits every transaction signature to company servers. This behavior has been active since context-module version 1.16, released in May 2026. The endpoint, named "blind-signing.api.ledger.com," fires a report on each signing request regardless of whether the user chooses blind or clear signing. I find it unacceptable that privacy is not the default setting for a security-focused product.
The Technical Reality
The data packet includes the device model, firmware version, and the specific blockchain address involved in the payment. It also lists app versions and flags if the user approved the transaction without seeing readable details. Ledger’s security team, Donjon, stated that this process supports Clear Signing by fetching descriptor files from their servers. These files are too large to store locally, so the SDK queries them remotely to improve performance. Donjon claims they do not store the transmitted data and that wallet makers can swap in custom modules to avoid this sharing. However, the overwhelming majority of users never opt out of this default configuration. A Ledger engineer merged a change on October 8 titled "Turn multichain sign reporter on," which posts events for Ethereum and Solana.
Kosev opened a pull request on September 24 to keep reports off unless explicitly enabled, and Ambire merged it on September 30. None of these affected releases reached Ambire’s live app, but the issue persisted in other wallet applications. Lefteris Karapetsas asked on social media if devices were phoning home with every signature record. Donjon and Yu Xian of SlowMist clarified that the code runs in the SDK, not the device firmware. This distinction matters because it means the exposure happens at the application layer, not the hardware level. Still, the fact that personal transaction metadata flows to a central server undermines the promise of self-custody.
Context and Accountability
Ledger co-founder Nicolas Bacca admitted in 2023 that he did not know why the system was opt-out rather than opt-in. He suggested it might have been an overlooked default. In 2023, Protos reported that Ledger Live sent clicks, account counts, and asset names to analytics firm Segment, though the company now requires consent for those trackers. A separate incident last month saw spyware in devices sold by a Malaysian reseller drain over $86 million from victims. That attack highlights how much trust users place in Ledger’s ecosystem. When the infrastructure itself leaks transaction data by default, the risk surface expands significantly. I would skip any wallet that does not allow full local control over signing metadata. The company must provide a transparent way to disable all external lookups without breaking core functionality. Until then, users should assume their transaction history is being logged.
