Ledger Faces Proposed $500 Million Class Action Over 2023 Data Breach and Crypto Theft

Ledger, the leading hardware‑wallet manufacturer, is confronting a proposed nationwide class action that seeks at least $500 million in damages. The complaint, filed in the U.S. District Court for the Southern District of New York, alleges that the company failed to protect customer data and to disclose the scope of a December 2023 security incident, leading to a large‑scale impersonation scheme and the theft of nearly $2 million in crypto assets.

December 2023 Incident and Alleged Failures

The lawsuit centers on a breach involving Ledger Connect Kit, a software library used to link hardware wallets with web applications. According to the filing, attackers accessed a former employee’s NPMJS account through a phishing attack, uploaded a malicious version of the library, and redirected user transactions to addresses under the attackers’ control. Ledger acknowledged that the compromised code could trick users into signing transactions that drained their wallets.

Impersonation Scheme and Reported Losses

Plaintiff Douglas Kim alleges that scammers used personal information obtained from the December breach to impersonate Ledger representatives. After receiving a phone call and a fraudulent email that appeared to come from Ledger, Kim entered his wallet passphrase on a counterfeit site, resulting in the loss of crypto assets valued at $1,948,074. The complaint states that similar impersonation attempts have continued into 2025 and 2026, including fake physical letters that directed recipients to phishing sites.

Historical Security Issues

The complaint also references Ledger’s 2020 breach, which exposed the personal data of more than 270,000 customers. The plaintiff argues that Ledger did not sufficiently improve its security practices after that incident and that the company’s public representations about encryption, two‑factor authentication, and continuous monitoring were misleading.

Legal Claims and Requested Relief

The filing lists seven causes of action, including violations of New York’s SHIELD Act and General Business Law Sections 349 and 350, negligence, negligent misrepresentation, promissory estoppel, and breach of the implied covenant of good faith and fair dealing. The plaintiff seeks actual, compensatory, statutory, treble, and punitive damages, as well as attorneys’ fees, costs, and a jury trial.

Potential Class Impact

The proposed class could include thousands of U.S. individuals whose personally identifiable information or crypto credentials were compromised. While the plaintiff estimates collective damages could exceed $500 million, the court has not yet determined any figures.