Ledger’s Developer Kit Reports Every Signature to Ledger Unless Wallets Opt Out, Ambire Developer Says

A developer at rival wallet maker Ambire said on Nov. 10 that Ledger’s signing kit, the software development kit (SDK) that wallet apps use to talk to Ledger hardware devices, sends details of every signature back to Ledger by default.
The developer, Kaloyan Kosev, wrote that each signature pings a Ledger server. The report names the network and the destination address, identifies the device and its firmware, lists the app versions in use and flags if the user approved the transaction blind. Blind signing means approving a transaction the device can’t show in readable form. He said the reporting has been on by default since version 1.16 of Ledger’s context-module package. “I’d argue that privacy should be the default,” he wrote.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

The Code Predates the Post
Ledger’s public changelog for the package lists a “blind signing reporter” added in version 1.16.0, then pointed at a production address, blind-signing.api.ledger.com, in version 2.1.0. A Ledger engineer merged a change on Oct. 8 titled “Turn multichain sign reporter on,” which posts signing events for Ethereum and Solana.
Ambire knew earlier still. Kosev opened a pull request on Sept. 24 that keeps the reports off unless a user turns them on, and Ambire merged it Sept. 30. He said none of the affected releases made it into Ambire’s live app.
Ledger’s Response
Ledger Donjon, the company’s security research team, replied on X that “this is part of how Clear Signing works.” Clear Signing is Ledger’s system for showing transactions on the device in plain terms, using descriptor files written to an Ethereum standard called ERC-7730. Donjon said those files are too big to keep on the device, so the default module looks them up on Ledger’s servers when a user signs, which means passing along enough of the transaction to find the match. It said Ledger does not keep that data, and that wallet makers can swap in their own module.
Some reactions put the code in the wrong place. Lefteris Karapetsas asked on X whether Ledger “devices with the latest ledger firmware are phoning home” and handing Ledger a record of every signature. Donjon and Yu Xian of security firm SlowMist, who posts as Cos, both said the code runs in the SDK, not in firmware.
The scrutiny comes a month after Ledger devices sold through a Southeast Asian reseller were drained in a separate attack.
Related Listen: Why a $100M Ledger Reseller Attack Has Crypto Rethinking Self-Custody

The post Ledger’s Developer Kit Reports Every Signature to Ledger Unless Wallets Opt Out, Ambire Developer Says appeared first on Unchained.