Ledger faces $500M class action lawsuit over data breaches and customer crypto theft

Sep 3, 2026

Ledger SAS faces a proposed $500 million class action lawsuit in New York, filed by user Douglas Kim, who claims he lost $1.95 million in cryptocurrency to scammers. The lawsuit alleges that Ledger failed to protect customer data and downplayed security incidents, specifically pointing to a December 2023 Connect Kit breach and a 2020 leak affecting 270,000 users. Kim alleges scammers used compromised contact details to run a sophisticated social-engineering scheme that drained his wallet in February 2025.

Ledger class action lawsuit

▪The lawsuit, docketed as case number 1:26-cv-07307-VM, seeks at least $500 million in damages on behalf of a proposed nationwide class of up to 210,000 Ledger users.
▪Douglas Kim filed a putative class action lawsuit against Ledger SAS on August 27, 2026, in the U.S. District Court for the Southern District of New York.
▪The lawsuit brings seven causes of action against Ledger SAS, including negligence, negligent misrepresentation, promissory estoppel, breach of the implied covenant of good faith and fair dealing, and violations of New York General Business Law Sections 349 and 350.
▪Ledger SAS told Protos that the company does not comment on legal matters.

December 2023 Connect Kit breach

▪The attackers uploaded a malicious version of Ledger's Connect Kit library that could redirect transactions to addresses they controlled by inducing users to approve fraudulent transactions.
▪Initial estimates placed the immediate losses from the December 2023 Connect Kit exploit between approximately $480,000 and $600,000, which Ledger later pledged to reimburse.
▪Attackers compromised the NPMJS account used to publish Ledger's Connect Kit software library on or about December 14, 2023, by phishing a former Ledger employee whose access had not been revoked.

Douglas Kim $1.95M theft

▪The lawsuit alleges, on information and belief, that the scammers used contact information compromised in the December 2023 incident to target Douglas Kim, while reserving the right to amend this claim after legal discovery.
▪Scammers posing as Ledger and Coincover representatives called Douglas Kim, claiming someone in the Netherlands had tried to register his details for the Ledger Recover seed-phrase recovery service.
▪On February 20, 2025, Douglas Kim discovered that cryptocurrency assets valued at $1,948,074 had been stolen from his Ledger wallet, none of which has been recovered.
▪The callers directed Douglas Kim to a phishing website, ledgerlivemanage.com, where he entered his confidential passphrase to reset his device.
▪Douglas Kim, a Los Angeles resident who purchased a Ledger wallet in 2017 and upgraded to a Nano X in New York City in 2021, was targeted by scammers on February 18, 2025.

2020 customer data breach

▪The 2020 breach remains active in litigation in the Northern District of California as Seirafi v. Ledger SAS, where a judge declined to dismiss claims in February 2025 that Ledger violated its privacy policy.
▪A 2020 data breach exposed the names, physical addresses, and phone numbers of more than 270,000 Ledger customers, with the leaked data subsequently uploaded to an online black market.

Alleged security failures

▪The lawsuit alleges that Ledger SAS demonstrated a pattern of negligent security practices by failing to implement adequate safeguards to protect customer personally identifiable information despite foreseeable risks.
▪The complaint alleges that Ledger SAS collected extensive customer data, including names, email addresses, delivery addresses, phone numbers, and payment details, while failing to protect it despite advertising robust security measures.

Alleged disclosure failures

▪The complaint claims that class members suffered financial losses that could have been prevented had Ledger SAS taken responsible and complete steps to notify its customers of the data exposures.
▪The lawsuit alleges that Ledger SAS downplayed its security breaches, failed to notify customers of the incidents in a timely manner, and failed to fully disclose the scope of the December 2023 incident.