Ledger SDK Sends Signing Metadata by Default

Ledger’s wallet-integration software includes a default reporting service that sends signing metadata to its servers, a behavior Ambire developer @0xSuperKalo highlighted on Nov. 10. Ledger’s public source code shows reports can include the network, destination address, device model and software versions, and whether signing was blind.

The mechanism sits in the software that wallet applications use to communicate with Ledger hardware. The version 1.16.0 implementation installs a network reporter unless the integrating developer supplies a replacement. Users’ exposure therefore depends on their wallet’s integration, rather than a firmware update alone.

The Ambire developer said no affected version had reached Ambire’s production application and that the wallet was shipping reporting disabled by default, with an opt-in toggle in privacy settings. “I'd argue that privacy should be the default,” the developer wrote.

What the Reports Contain

Ledger’s release record dates context-module 1.16.0 to April 14 and describes adding a blind-signing reporter to the module. The accompanying Ethereum signing code builds reports for transactions and typed-data signing, including when the operation is classified as not blind signing.

The report-building code supplies a generated signing-event identifier, signing method, chain ID, target address, blind-signing status and reason, device model, signing-app version and firmware version when available. It also includes the clear-signing type and a count of context errors when that information is available. Clear signing concerns presenting transaction details in readable form before approval.

The HTTP implementation adds an application-source label and sends the report with headers identifying the context-module version and the integration’s origin token. The report builder does not include private keys, a recovery phrase or the cryptographic signature itself.

The destination also changed over time. Version 1.16.0 configured a staging ingestion address; Ledger’s later changelog records switching to the production blind-signing endpoint in version 2.1.0. The current builder points the reporter to https://blind-signing.api.ledger.com/ingest.

For wallet developers, the builder exposes a way to replace the default reporter. Ambire’s developer says its implementation will give users a privacy-setting toggle, with sending reports turned off by default.