Ledger’s signing kit for wallet developers sends a report to a Ledger server every time someone signs an Ethereum or Solana transaction with a Ledger device through a wallet that keeps the kit’s default settings. Kaloyan Kosev, a developer at the wallet maker Ambire, raised it on X on 10 November 2026. The code on Ledger’s GitHub shows what goes out: the network, the address the transaction is sent to, the device model and firmware, the version of the Ledger app on the device and whether the user signed blind. Ledger’s security team, Ledger Donjon, answered late that evening that this “is part of how Clear Signing works” and that Ledger keeps none of the data, Unchained reported.
This is a privacy question about Ledger, not a theft. No source, Ledger’s critics included, says the reports can move funds or expose a private key: they carry metadata about each signature, not secrets. The argument is about who decides whether a wallet’s users are counted, and whether that should be on until someone switches it off.
The reporting lives in @ledgerhq/context-module, a package of Ledger’s open-source Device Management Kit that third-party wallets build into their apps. It is not in the device firmware. Ledger Donjon and Yu Xian of the security firm SlowMist both said so on X after the developer Lefteris Karapetsas asked whether devices on the latest firmware were “phoning home”, according to Unchained.
What the Ledger signing kit sends, field by field
Coindaro read the code of the package as it stood on Ledger’s develop branch at 05:50 UTC on 12 November. For an Ethereum transaction, each report holds the chain ID, the transaction’s to address (the recipient, or the contract being called), the four-byte code of the contract function when there is one, the signing method, whether the screen used a basic or an ERC-7730 clear-signing format, a count of partial context errors, and a yes or no on blind signing with a reason. For signed typed data, the address is the contract named in the message.
Every report also carries the device model, the version of the Ethereum or Solana app installed on the Ledger, the device firmware version and a source label, which defaults to “third-party”. The format has optional fields for the wallet’s platform, its own version and the phone or computer operating system, but Ledger’s default Ethereum and Solana code leaves them empty; a wallet that writes its own reporter can fill them. Each report gets an identifier made of six random characters and the time of signing to the millisecond.
Solana reports list the programs the transaction calls and the ones Ledger could not recognise. The “target address” there is the first program other than Solana’s System Program, so a plain SOL transfer reports no target at all. The report format has room for the Solana transaction signature, which would point to the exact transaction on-chain, but the default Solana code does not fill it in.
What is missing matters too. The user’s own address is not a field in either format, which Ambire also noted in its pull request of 24 September. The payload has no IP address field either, though Ledger’s server, like any server, sees the internet address each request comes from. On Ethereum, a wallet on version 2.7.0 or later sends two reports per signature: one through the original reporter and one through the newer “sign reporter”, posted to /v2/blind-signing-events.
From a Ledger staging server in April to Solana in October
The feature arrived in stages, all listed in the package’s changelog. Version 1.16.0, published on npm on 14 April 2026, added a “blind signing reporter” and plugged it into the module. At that point the default address was a Ledger staging server. Version 2.1.0, on 26 May, switched the default to the production endpoint https://blind-signing.api.ledger.com. Protos, which reported the story on 11 November, dates the first reporter commit to 26 March.
A second, multichain reporter appeared in 2.5.0 at the end of August and was switched off again before that version shipped. Pull request #1966, opened and merged on 8 October (merged at 13:54 UTC), turned it back on for Ethereum and Solana. Its description says signing events “are now posted to” the v2 endpoint for both chains; it names the feature “Multichain blind-sign tracking”. The change reached npm in version 2.7.0 on 16 October. The latest release, 2.8.0 of 21 October, keeps it, and no change to the reporters had been merged or opened as of 05:50 UTC on 12 November.
| Date (2026) | Package version or event | What changed |
|---|---|---|
| 14 April | context-module 1.16.0 | Ethereum signing reports added, pointed at a Ledger staging server |
| 26 May | 2.1.0 | Default address moved to blind-signing.api.ledger.com (production) |
| 28 August | 2.5.0 | Second, multichain reporter added, then disabled before release |
| 24 to 30 September | Ambire pull request #2730 | Ambire turns reports off by default, opt-in only |
| 8 October | Ledger pull request #1966 merged | Multichain reporter switched on for Ethereum and Solana |
| 16 October | 2.7.0 | First release with the switch; 2.8.0 followed on 21 October |
| 10 November | Kosev’s post, Donjon’s reply that evening | Default made public; Ledger says it keeps no data |
Ledger’s answer: Clear Signing needs the lookup, and nothing is kept
Clear Signing is Ledger’s name for showing a transaction on the device screen in words a person can check, such as the token, the amount and the contract of a swap, instead of a string of hex. It relies on descriptor files written to ERC-7730, a draft Ethereum standard created in February 2024 that tells a wallet how to label and format a given contract call. When no descriptor matches, the user is asked to sign blind, approving data the screen cannot explain.
Ledger Donjon’s argument, as relayed by Unchained and Protos, is that these files are too large to keep on the device, so the default module looks them up on Ledger’s servers at signing time. “That requires sending the transaction details needed to find the right descriptor,” Donjon wrote, according to Protos. Ledger says it retains none of that data and that wallet makers can plug in a module of their own.
The code supports part of that and leaves part open. In the kit, descriptor lookups go to a different Ledger address, the Crypto Assets List service at global.api.prd.ledger.com/cal/v1. The reports go to the blind-signing endpoint after the kit has decided whether the signature was clear or blind, and they carry that verdict. They read as a record of how often clear signing fails and on which contracts, which fits the feature’s own name, more than as the lookup itself. Ledger has not published what it does with the reports, how long its servers hold request logs, or a privacy notice specific to this endpoint. Nobody outside Ledger has checked the claim that nothing is kept.
Who is affected: wallets built on the kit, not the device itself
No list of wallets using the kit with its defaults has been published. Protos wrote that apps must opt out and that “the overwhelming majority do not”, without a count. Ambire is the one named case, and it says no version with the reports switched on reached its live app: its code now keeps them off unless the user turns them on in the privacy settings, according to Unchained.
For someone holding a Ledger Nano X or another Ledger, the reports do not leave from the device. They are sent by the wallet app on the phone or computer, which talks to the internet; the device only signs. A firmware update does not change them, and Ledger has not asked anyone to move funds or change a recovery phrase. This is also a separate matter from the tampered Ledger devices Singapore police warned about in October.
How to turn Ledger’s signing reports off
For users, the only lever is the wallet. Ambire users already have reporting off unless they opt in. Users of other wallets that connect a Ledger can ask the wallet maker whether it ships Ledger’s context-module with the default reporter, and on which version: Ethereum reports from 1.16.0 (to production from 2.1.0), Solana reports and the second Ethereum report from 2.7.0.
For wallet makers, Ledger’s builder offers three routes in the current code:
setReporterConfigchanges the address both reporters post to, for example to a server the wallet runs itself.setBlindSigningReporterreplaces the original reporter with one the wallet writes, which can simply do nothing.- A wallet can hand the signer a context module of its own, the route Ledger Donjon pointed to.
There is no builder switch to replace the newer multichain reporter on its own; a wallet that wants it gone has to redirect the address or supply its own module. A Ledger default that sends nothing would remove the need for any of this.
Privacy by default, and the questions Ledger has not answered
“I’d argue that privacy should be the default,” Kosev wrote, according to Unchained. An address and a device model are not secrets on their own. Sent on every signature with a firmware version, though, a destination address can be set against the public, time-stamped record of a blockchain, and the reports go to Ledger unless the wallet maker changes the default. Nicolas Bacca, a Ledger co-founder who left the company in 2023, said the default might have been “overlooked”, Protos reported.
Ledger is a Paris-based company, and under EU data-protection law, information that can be tied to an identifiable person can count as personal data. No data-protection authority had commented publicly by 12 November, and Ledger has published no blog post or advisory on the reports.
The next step is Ledger’s. It can flip the default to off in a new context-module release, publish what the blind-signing endpoint keeps and for how long, or leave wallets to opt out one by one. Anyone setting up a device can check how the wallet app they pair it with treats data in our guide to setting up a hardware wallet.