Ledger, the well-known hardware wallet provider, reportedly suffered a new security incident on January 5, 2026. Blockchain investigator ZachXBT revealed that customer personal data had been compromised through the third-party payment processor Global-e.
The latest breach exacerbates concerns over crypto security, coming only days after Trust Wallet users suffered unauthorized fund outflows, and hours after attackers targeted MetaMask users.
Global-e Breach Exposes Ledger Customer Information
According to ZachXBT, emails sent to affected users show that names and contact details were accessed without authorization. Ledger reportedly acknowledged detecting unusual activity within a portion of its cloud infrastructure linked to Global-e. Based on the report, they acted quickly to contain the incident.
The company also engaged independent forensic experts to investigate the breach and ensure that systems were secured.
There is no indication that wallet funds or private keys were compromised. However, experts warn that affected customers face heightened risks from phishing campaigns and scams. THis sie because exposed data can be used for targeted social engineering attacks.
The Ledger incident highlights the risks posed by relying on external vendors for payments and logistics. When third-party providers manage sensitive customer information, the potential attack surface grows considerably.
Continuous monitoring and rigorous vetting of partners are essential to prevent breaches that could compromise both personal data and broader trust in the ecosystem.
Is the Crypto Industry’s Security Failing?
This breach revives concerns from Ledger’s 2020 incident, in which attackers accessed e-commerce and marketing databases, exposing the personal information of hundreds of thousands of users.
That earlier breach led to widespread phishing attempts. It targeted users with fraudulent schemes designed to steal recovery phrases and crypto assets.
Repeated incidents like this put pressure on Ledger to strengthen vendor management, internal security protocols, and customer education on safeguarding assets against phishing and scam attempts.
Meanwhile, this report comes only hours after bad actors targeted MetaMask users. As BeInCrypto reported, these bad actors deployed phishing scams that mimic two-factor authentication (2FA) verification to steal user seed phrases.
The Ledger breach also comes barely two weeks after the Trust Wallet Chrome extension hack affected roughly $7 million in user funds. The incident prompted Binance founder Changpeng Zhao to suggest potential insider involvement.
Investigations hghlighted the vulnerabilities inherent in update pipelines, credential management, and third-party dependencies.
Together, these events indicate systemic weaknesses in the industry. Supply chain risks, extension-based attacks, and vendor breaches are now critical concerns for wallet providers.
As crypto adoption grows, the industry continues to strike a balance between convenience and security. At the same time, threat actors are relentlessly target the weakest links in the chain.
