The default SDK used by wallet apps to communicate with Ledger devices transmitted transaction signatures, device model, software version, and queried blockchain addresses to the company’s servers. The behavior, enabled by default since context-module version 1.16, widely reached users between April and May 2026 without explicit consent. Ledger said clear signing requires retrieving from its servers descriptors that are too large to be processed directly on the device, but the company claims it retains none of the data. Apps and users must explicitly disable the sharing, which the vast majority do not. Ledger added that wallets can be configured to use a custom module, while co-founder Nicolas Bacca said he did not know why the option had been enabled by default.
Source: Read the original article
