Ledger blockchain: security incident confirmed on partner platform, crypto assets protected

Ledger, the Paris-based crypto wallet manufacturer with over 12 years of industry experience, has disclosed a data breach affecting Global-e, its partner for international e-commerce operations. However, the company emphasizes that the self-custodial nature of its products ensured that no digital assets were exposed.

The scope of the breach and what was compromised

Unauthorized access targeted Global-e’s IT systems, with particular focus on data related to orders placed on Ledger.com through this merchant platform. What makes this incident significantly less severe compared to other breaches in the industry is data compartmentalization: since Ledger wallets are based on a self-custodial model, Global-e never had access to critical information such as 24-word recovery phrases, blockchain balances, or details of assets held by users. Similarly, no payment-related information was involved in the breach.

The role of Global-e and the partner context

Global-e operates as a global platform specializing in cross-border payments and e-commerce, enabling international brands to sell their products in different markets. Listed on Nasdaq under the ticker GLBE and headquartered in Israel, the platform serves hundreds of retailers, from Victoria’s Secret and Adidas to Alo Yoga and Marc Jacobs.

Ledger’s operational scale and impact on blockchain security

With over 7.5 million devices distributed worldwide, Ledger solutions custody approximately 20% of global crypto assets. This operational scale makes the incident even more sensitive, although the technical structure of the wallets has prevented direct compromise of digital assets.

Actions taken and ongoing investigations

Ledger has engaged independent forensic experts to conduct a thorough investigation into Global-e’s systems to determine the extent of unauthorized access and the technical causes of the breach. This approach reflects the company’s commitment to transparency and clarity for users regarding platform security.

This incident is the latest in a series of vulnerabilities identified in technical infrastructures connected to the Ledger ecosystem. In December 2023, the company had already announced an incident involving Ledger Connect Kit, where malicious code was introduced through phishing targeting a former employee.