Ledger Is Getting Sued for $500M — and Not a Single Private Key Was Hacked

Here’s the part that should make you put down your coffee: the lawsuit filed against Ledger doesn’t allege that anyone broke the encryption on a Nano. Nobody cracked the secure element. Nobody extracted a seed phrase off the chip.

They stole a customer list. That was enough.

A proposed class action filed on August 27, 2026 in the U.S. District Court for the Southern District of New York is seeking at least $500 million from the hardware wallet maker — a number the complaint says could run into the billions depending on how many customers turn out to be affected.

What the Complaint Actually Claims

The named plaintiff, Douglas Kim, says he lost roughly $1.95 million in crypto after scammers used compromised Ledger customer information to impersonate company representatives and talk their way into his wallet.

The suit strings together two incidents that Ledger customers have been living with for years:

The 2020 breach. Personal information for over 270,000 customers was exposed — names, email addresses, phone numbers, physical shipping addresses. Not keys. Just a map of exactly who owns a hardware wallet and where they live.

The December 2023 Connect Kit compromise. A malicious version of Ledger Connect Kit — a software library that dapps load to talk to Ledger devices — was pushed live and could redirect transactions. Ledger acknowledged the access control failure at the time, said it would reimburse affected users, and committed to phasing out blind signing for certain applications.

The complaint alleges Ledger failed to properly notify customers after the December 2023 incident and did not fully disclose its scope. It brings seven causes of action, including violations of New York General Business Law §349 and §350 (deceptive acts and false advertising), negligence, negligent misrepresentation, promissory estoppel, and breach of the implied covenant of good faith and fair dealing.

One detail is doing a lot of work in the filing: the theft is alleged to have happened roughly 14 months after the breach that exposed the data used to pull it off. Leaked PII doesn’t expire. It just sits in a database waiting for someone patient.

These are allegations. Nothing has been proven, no class has been certified, and Ledger has not been found liable for anything. Ledger has not issued a public response to this specific filing at the time of writing.

Why This Is Bigger Than One Lawsuit

2026 has been a brutal year for the “just self-custody, bro” thesis.

In late July, an attacker began exploiting a five-year-old firmware flaw in Coinkite’s Coldcard, systematically draining bitcoin from air-gapped devices. Losses blew past $130 million — the third-largest crypto hack of the year, on hardware that never touches the internet.

Now the other major hardware wallet brand is facing a nine-figure class action over data hygiene.

The through-line isn’t that hardware wallets are broken. It’s that the threat model moved and the industry didn’t. Attackers stopped trying to beat the cryptography — which is genuinely hard — and started attacking the humans, the supply chain, and the CRM. Your seed phrase is protected by a secure element. Your identity as someone worth targeting was sitting in a marketing database.

You cannot cold-storage your way out of a phone call from someone who knows your name, your address, and the exact model you ordered.

Why This Matters for Crypto Jobs

Every one of these incidents converts directly into headcount. Here’s where the demand is landing:

Security engineers are eating. Not “audit the Solidity” security — that market is mature. The growth is in product and infrastructure security: supply chain integrity, dependency pinning, build reproducibility, npm/CDN provenance. The Connect Kit incident was a supply chain compromise, not a smart contract bug. Firms are hiring people who can lock down a release pipeline, and paying up for it.

Incident response and disclosure is now a real function. A meaningful share of this lawsuit is about notification — what the company said, when, and how completely. That’s a job. Companies are staffing dedicated incident comms and disclosure roles because the legal exposure from a botched notification now rivals the exposure from the breach itself.

Data protection and privacy engineering. The 2020 breach was a third-party e-commerce/CRM leak. Every crypto company sitting on a customer list — exchanges, wallet makers, hardware vendors, launchpads — just got a very expensive lesson in data minimization. Expect privacy engineers and GRC hires who can answer “why do we still store this?”

Anti-social-engineering and trust & safety. Impersonation is the attack. Teams are building detection for it, training for it, and staffing support orgs that can’t be spoofed.

Signing UX and clear signing. The push away from blind signing — ERC-7730 and friends — is a design and frontend problem as much as a cryptography one. If you can make a transaction legible to a normal human before they approve it, you are employable right now.

The uncomfortable read for builders: the security jobs are moving away from the chain. The chain is mostly fine. The onboarding flow, the customer database, the release pipeline, and the support inbox are where the money is actually leaving. If you’re a security person trying to break into crypto and you’ve been grinding CTFs and audit contests, know that the roles opening fastest are the boring-sounding ones — appsec, supply chain, IR, privacy.

The Bottom Line

The most expensive vulnerability in crypto this year wasn’t in a smart contract or a secure element. It was a list of names and addresses.

If a $500 million class action over customer data doesn’t make every wallet company in the industry re-examine what they’re storing and who they’re telling about it, the next filing will be bigger.

---

Looking for a role in crypto security, infrastructure, or protocol engineering? The teams cleaning up messes like this one are hiring — and they’re paying for people who understand that the attack surface extends way past the contract. Browse open Web3 roles at Cryptogrind.