ZachXBT exposes: Ledger users' privacy faces further threats, with the payment process becoming a weak point

On-Chain Security Researcher ZachXBT recently disclosed a concerning incident—another data breach involving hardware wallet manufacturer Ledger’s customer data, this time attributed to its third-party payment service provider.

According to circulated customer notification emails, the payment service provider detected abnormal activity traces within its network systems. After identifying issues with its cloud infrastructure, the company quickly activated its emergency response plan and engaged an independent cyber forensic team for an in-depth investigation. The investigation revealed that personal information, including user names, phone numbers, emails, and more, was accessed illegally.

This is not Ledger’s first encounter with a data breach. As a well-known provider of cold wallet solutions in the industry, Ledger has a large customer base, and user privacy concerns have always been a focal point within the community. This incident once again highlights that even large digital asset management platforms still have significant vulnerabilities in their third-party service integrations.

ZachXBT’s exposure serves as a reminder to users that protecting their private information requires attention not only to the security measures of the main service provider but also to seemingly minor supporting links such as payment and settlement processes—these nodes often become hackers’ entry points. For users holding digital assets, this is a warning: when choosing wallets and related services, it is essential to consider not only brand reputation but also the overall security level of the entire ecosystem.