# @0xSuperKalo: Ledger SDK sent signing data to Ledger

Source: https://x.com/0xSuperKalo/status/2120151879585816931
Kiwi News: https://news.kiwistand.com/stories/0xSuperKalo-Ledger-SDK-sent-signing-data-to-Ledger?index=0x6af37d66f722808c9e4944652a9adb04650f39766efa7ef50ab8b43871aad58b388f3f45
Submitted by tim on 2026-11-10 UTC, 3 upvotes, 1 comment

If your wallet of choice isn’t @ambire and it runs Ledger’s latest signing kit, chances are every signature you make gets reported back to Ledger.

I noticed it early while bumping Ledger packages to debug an issue! No affected version ever reached Аmbire production, and we’re shipping it disabled by default, with an opt-in toggle in the privacy settings 🛡️

However, the devil was that it was sneakily enabled by default in the Ledger SDK since their ledgerhq/context-module v1.16... So right after the lib update - every transaction you sign with a Ledger device started sending to http://blind-signing.api.ledger.com the network, the contract or recipient address, device model and firmware, app versions and whether you signed blind.

I'd argue that privacy should be the default, @Ledger 💪

Happy to see more and more people becoming aware of the privacy implications and picking Ambire for our ongoing privacy focus.

Catching things like this 👀 is part of the job for us!

## Comments

**thatalexpalmer.eth**: Chat, how do we feel about hardware wallets these days. I think an iPhone with nothing but a multisigs wallet does a better job