Ledger's wallet-integration software includes a default reporting service that transmits signing metadata to the company's servers — a behavior Ambire developer @0xSuperKalo highlighted on Nov. 10. Ledger's public source code shows the reports can include the network, destination address, device model, software versions, and whether signing was performed blind.

The mechanism sits in the software that wallet applications use to communicate with Ledger hardware. Hardware wallets keep private keys isolated on the device, and wallet apps reach them through these reusable software development kits — which means a default inside the SDK applies everywhere it ships. The version 1.16.0 implementation installs a network reporter unless the integrating developer supplies a replacement. Users' exposure therefore depends on how their wallet integrates the SDK, rather than on a firmware update alone.

The Ambire developer said no affected version had reached Ambire's production application and that the wallet ships with reporting disabled by default, offering an opt-in toggle in privacy settings. "I'd argue that privacy should be the default," the developer wrote.

What the Reports Contain

Ledger's release record dates context-module 1.16.0 to April 14 and describes adding a blind-signing reporter to the module. The accompanying Ethereum signing code builds reports for transactions and typed-data signing, including when the operation is classified as not blind signing.

The report-building code supplies a generated signing-event identifier, signing method, chain ID, target address, blind-signing status and reason, device model, and signing-app and firmware versions when available. It also includes the clear-signing type and a count of context errors when that information is available. Clear signing refers to presenting transaction details in readable form before approval; blind signing is its counterpart — approval of data the device cannot display in readable form. Destination addresses are pseudonymous on public blockchains, but each report pairs a target address with the signing method, device model, and software versions in a single payload delivered to Ledger's servers.

The HTTP implementation adds an application-source label and sends the report with headers identifying the context-module version and the integration's origin token. The report builder does not include private keys, a recovery phrase, or the cryptographic signature itself — placing the reported behavior in the category of metadata collection rather than key custody.

The reporting destination has changed over time. Version 1.16.0 configured a staging ingestion address, and Ledger's later changelog records a switch to the production blind-signing endpoint in version 2.1.0. The current builder points the reporter to

For wallet developers, the builder exposes a way to replace the default reporter. Ambire's developer says its implementation will give users a privacy-setting toggle, with sending reports turned off by default. For users, the deciding factor is the wallet they run: whether its developers kept the default reporter or replaced it — a choice made in application code rather than in device settings. With the default reporter now aimed at Ledger's production ingestion endpoint as of version 2.1.0, how wallet makers configure the module is what to watch next.