Lawyer Ariel Givner: Ledger Faces Class Action Lawsuit Due to 2023 Incident
Lawyer Ariel Givner disclosed that hardware wallet manufacturer Ledger SAS has been hit with a class action lawsuit in the Southern District of New York, case number 1:26-cv-7307. Plaintiff Douglas Kim is suing on behalf of similar users, with the complaint dated August 27, 2026.
The complaint refers to the December 2023 security incident as a data breach, accusing the company of downplaying its severity and failing to disclose it in a timely and complete manner, resulting in the exposure of customers' personal identity information such as names, emails, and phone numbers, which were used to impersonate Ledger and induce approval of fraudulent transactions. Relevant information has reportedly flowed into the dark web and black market. The same complaint also states that around December 14, an NPMJS account used to release the Ledger Connect Kit was compromised by unauthorized personnel, leading to a malicious version that altered some users' transaction paths. At that time, the company claimed that an employee was phished, after which the attacker released a malicious library, with a window of less than two hours, resulting in reported on-chain losses of approximately $484,000, affecting multiple DeFi frontends using that library.
The plaintiff describes a previous 2020 case as a "malicious pattern": e-commerce and marketing databases were exported by internal personnel through Shopify and customer service outsourcing TaskUs, with about 272,000 records containing names, addresses, phone numbers, and orders publicly disclosed on forums in December of that year, along with approximately one million email addresses; the company initially reported about 9,500 individuals but later expanded notifications. The ongoing case in the Northern District of California, Baton/Seirafi (3:21-cv-02470), is still reviewing this leak. In January 2026, Global-e, the checkout and fulfillment partner, again exposed customer data related to orders, with the company stating that no payment card information was involved.
The allegations include violations of New York General Business Law Sections 349 and 350, negligence, negligent misrepresentation, estoppel, and implied contracts of good faith and fair dealing, citing notification obligations under New York's SHIELD Act. The complaint states that Ledger has sold approximately 7 million units, covering about 180 countries; plaintiff Kim is personally claiming at least $2 million, with collective damages hypothetically estimated to start at $500 million, with no upper limit. All these figures are claims made in the lawsuit and have not been confirmed by a judgment.
Who is buying and who is selling: The incident is driven by a security premium lawsuit, not by devices remotely extracting private keys. Funds are flowing from "self-custody is absolutely secure" marketing to legal fees, notification compliance, and third-party e-commerce risk control; benefiting are the plaintiffs who can connect phishing losses to delayed disclosures, while under pressure are hardware wallet manufacturers that tie chip security and order databases under the same brand. The chip remains intact, but the contact list has been compromised, shifting pricing power to whether it can be proven that "failure to timely inform led to avoidable authorizations."
The 2020 leak list was once quoted at about $100,000 among hackers; subsequently, there were instances of counterfeit device replacement packages and SMS phishing. The lawsuit aims to link supply chain poisoning, contact list leaks, and asset fraud into the same negligence chain.
Source: Public Information
ABAB AI Insight
Ledger's history of lawsuits did not begin with this New York case. After the 2020 customer database was posted on RaidForums, California already had class action lawsuits against Ledger, Shopify, and TaskUs, focusing on whether delayed notifications and phishing losses could be attributed to them. In 2023, Recover extracted seed shards from devices, leading to parallel cases in New York, Illinois, and California questioning whether the claim of "private keys never leaving the device" constituted misleading advertising. The new case in New York in 2026 incorporates supply chain poisoning of the Connect Kit into the same "pattern" narrative, effectively using three different attack surfaces against the same brand promise.
The capital path is high-margin hardware plus subscriptions: the secure components of devices sell the story of "keys not leaving the chip," while the e-commerce database and NPM publishing rights sell growth and integration. Funds have not been simultaneously invested in vendor permissions isolation at the same level as the chips, leading to attacks through customer service outsourcing, checkout service providers, and former employee credentials. The motivation is that customer acquisition must collect addresses and phone numbers, and DeFi must integrate connection libraries into third-party frontends, both of which do not align with the advertising of "keys in the chip" within the same security boundary.
Comparative cases include the Trezor order information leak, the trust fracture caused by Ledger Recover, and all hardware manufacturers that tie logistics lists to cryptocurrency identities. The industry phase has shifted from "competing on secure chip certifications" to "competing on disclosures and third-party governance," while expansion continues to sell devices, control is now in the hands of lawyers and state law notification clocks.
The structural change is the transfer of pricing power: users buy the chip story, while compensation disputes are over contact lists and frontend scripts. The mechanism is that social engineering does not require dismantling secure components; as long as the list is accurate enough and the official tone is convincing enough, the authorization itself will lead to asset outflow; delayed disclosures are framed as proximate causes of losses, allowing negligence to be priced in cryptocurrency terms.
ABAB News · Cognitive Laws
The chip remains intact, but the contact list has been compromised, and assets still flow out.
Security sells boundaries, while lawsuits target notifications.
This is the third similar incident, no longer treated as an accident.