Major hardware crypto wallet manufacturer Ledger has once again found itself at the center of a legal scandal. This time, the company is facing a class-action lawsuit filed in the U.S. District Court for the Southern District of New York. The plaintiff—Douglas Kim—accuses the firm of concealing the scale and consequences of a data breach that occurred in December 2023.
The Core of the Claims: An Underestimated Threat
According to my analysis of the court documents, the incident affected confidential client information: names, email addresses, phone numbers, and other personally identifiable information (PII). The plaintiff's key argument is that the company deliberately downplayed the severity of what happened and provided information with significant delay, which exacerbated risks for users.
Special attention in the lawsuit is given to the connection between the breach and a wave of social engineering attacks. Attackers, posing as official Ledger representatives, contacted victims, convincing them to approve fraudulent transactions. As a result, trusting users lost their crypto assets, believing they were interacting with legitimate support services.
The Shadow of 2020: A Systemic Problem?
Notably, the lawsuit also references an earlier incident—the 2020 breach, which reportedly affected approximately 270,000 clients. That case had already dealt a serious blow to Ledger's reputation, and now the plaintiff insists that the company failed to learn the proper lessons, leading to a repeat of the situation. The allegations include violations of consumer protection laws, negligence, and unfair business practices.
Against this backdrop, it is worth recalling recent technical issues as well. In August, the OneKey Anzen team reproduced a transaction substitution attack on the Ledger wallet's Ethereum application version 1.22.1 under test conditions. Although the vulnerability was promptly patched, the very fact of its existence raises questions about the company's comprehensive approach to security—both at the hardware level and at the level of software and client data management.
My conclusion: This lawsuit is not merely a legal formality but a signal of a systemic crisis of trust. For an industry where security is the primary asset, recurring incidents and allegations of information concealment could prove more devastating than any market fluctuations. Ledger faces not only defending itself in court but also proving to users that their funds and data are reliably protected—a task that becomes increasingly difficult with each new lawsuit.