Ledger Data Breach Reported, Wallets Unaffected

This isn’t Ledger’s first encounter with third-party issues. In December 2023, malicious code was injected into Ledger Connect Kit after a former employee fell victim to phishing. At the time, Ledger advised users to stop using dapps until the vulnerability was resolved.

The company’s most high-profile incident occurred in 2020, when attackers leaked the personal data of over 270,000 customers. That breach exposed names, emails, phone numbers, and even home addresses. It later led to phishing attempts, a bitcoin bounty hunt, and a class-action lawsuit against both Ledger and Shopify.

What Is Global-e?

Global-e is a Nasdaq-listed global retail and payment platform based in Israel. It powers e-commerce services for brands like Victoria’s Secret, Adidas, and Marc Jacobs. Ledger uses it for international transactions on its main online store.

The fact that Global-e serves hundreds of companies raises additional questions about the broader impact of the breach across other merchants.

Crypto Data Breaches Since 2024

Why It Matters

Ledger’s hardware and software remain untouched, but the incident still raises trust concerns. As hardware wallets continue to position themselves as the gold standard in crypto security, how they manage third-party integrations will come under more scrutiny.

While no crypto was stolen, the repeated involvement of external vendors in data leaks highlights an ongoing vulnerability even for self-custodial tools.

Ledger says it remains committed to transparency and user protection, but as past incidents show, user data, not just crypto, is often the real target.