.jpg)
The Connect Kit attack at the center
The December 2023 incident involved Ledger Connect Kit, a software library used to connect hardware wallets with websites and decentralized applications. According to the complaint, attackers gained access to the NPMJS account of a former Ledger employee through a phishing attack after the company failed to properly revoke the employee's access following the end of their employment.
Once inside, the attackers uploaded a malicious version of Ledger Connect Kit that could redirect transactions to addresses they controlled by inducing users to approve malicious transactions. Ledger publicly acknowledged that the malicious software could trick users into signing transactions that drained their wallets. CEO Pascal Gauthier said at the time that the incident was isolated to third-party applications and that Ledger hardware wallets remained unaffected. Estimates put losses from the Connect Kit exploit between roughly $480,000 and $600,000, and Ledger later said it would reimburse affected users and announced plans to phase out blind signing for Ethereum virtual machine decentralized applications.
The new lawsuit reaches far beyond those immediate losses. Kim alleges that hackers accessed and used Ledger customer data — names, email addresses and phone numbers — and that Ledger failed to give customers sufficient warning about the incident.
How nearly $2 million walked out the door
Kim, who first bought a Ledger hardware wallet around 2017 and purchased a Nano X in New York City in 2021, says he became the victim of a Ledger impersonation scheme on Feb. 18, 2025. A caller claiming to represent Coincover, presented as a department within Ledger, told him that someone in the Netherlands had attempted to register for Ledger Recover using his information and that his crypto assets could be at risk, according to the complaint.
A second person posing as another Ledger representative then asked Kim to check his email as proof of legitimacy, and he received what appeared to be an official message from the company. The complaint alleges, on information and belief, that the attackers used customer contact information originating from the December 2023 incident to identify him as a target and trigger the email. The purported representative directed Kim to a website designed to resemble Ledger's services and instructed him to enter his confidential passphrase to reset the device. He complied, received what he believed was a replacement passphrase, and two days later discovered that cryptoassets valued at $1,948,074 had been stolen. None have been recovered.
Impersonation attempts against Ledger customers have continued. In February 2026, scammers sent fake Ledger letters directing recipients to phishing websites designed to collect wallet recovery phrases, and similar physical mail attacks were reported in April 2025 using data leaked in 2020. Crypto theft has grown more aggressive across every vector, from home invasions to contract exploits like the Rain card incident.
A history of breach allegations
Kim's lawsuit uses Ledger's earlier security record to support its claims. A 2020 breach affected more than 270,000 customers, exposing names, physical addresses and phone numbers, and the data later became available on black market channels. Litigation over that breach was separately brought in the Northern District of California. The new complaint alleges Ledger failed to sufficiently improve its security practices afterward and accuses the company of downplaying both incidents.
The complaint argues Ledger's security representations were particularly important because the company requires customers to provide information when buying its products, collecting names, email addresses, delivery addresses, phone numbers, payment details, product information and order amounts. Ledger has advertised encryption, employee training, role-based authentication, two-factor authentication, continuous system monitoring and independent security testing — measures the lawsuit alleges were deceptive given the breaches.
What the case could mean
The complaint brings seven causes of action, including claims under New York General Business Law Sections 349 and 350, negligence, negligent misrepresentation, promissory estoppel and breach of the implied covenant of good faith and fair dealing, and seeks actual, compensatory, statutory, treble and punitive damages.
A $500 million class action against the industry's most recognized hardware wallet brand would test how courts weigh custodial-adjacent responsibilities for companies that market self-custody but hold customer data. For now, the case remains a proposed class action — the court must first decide whether to certify the class before any collective damages can proceed. Ledger has not publicly responded to the complaint, and the allegations remain unproven claims until litigated.
