The Ledger Breach Led to Kidnappings. Your Address Is Your Attack Surface.
In July 2020, Ledger, the French hardware wallet company, was hacked. Attackers pulled data from its e-commerce and marketing systems. By December 2020, the full dataset was on RaidForums: 272,000 customer records with names, phone numbers, and home addresses, plus more than one million email addresses.
These were not random records. They identified people who bought hardware wallets and likely held crypto. Within a year, physical attacks followed. By January 2024, criminals had kidnapped and tortured Ledger's co-founder. The breach did not just expose customers. It built a target list.
What happened
Attackers got into Ledger's e-commerce stack through an exposed API tied to a third-party partner. They did not steal seed phrases or private keys. They stole shipping data: who ordered, what they bought, and where they lived.
Ledger disclosed the breach in July 2020 and said about one million email addresses were exposed, with a much smaller set of personal records affecting around 9,500 customers. That picture was wrong. In December 2020, the full database surfaced and showed about 272,000 full records.
For five months, many customers thought their exposure was limited when it was not.
How criminals used it
The Ledger dump became a working dataset for crypto crime. A name, an address, and proof of crypto interest gave attackers a short list of people worth targeting.
- Phishing and extortion emails - Ledger customers got threats saying attackers knew where they lived and would visit unless crypto was sent.
- SIM-swap attacks - phone numbers from the dump were used to hijack mobile accounts and bypass exchange 2FA.
- Physical surveillance - in higher-value cases, criminals watched addresses before making contact.
- Physical robbery and kidnapping - the end point. Several attacks in France and elsewhere involved criminals going straight to exposed addresses.
The Balland kidnapping
The worst-known case came in January 2024. David Balland, one of Ledger's eight co-founders, was abducted from his home in central France. His partner was also taken.
The kidnappers cut off one of Balland's fingers and sent it to Ledger executives with ransom demands. French police launched a major operation. Balland survived. Ten suspects were arrested. It became one of the most serious crypto-related physical attacks in Europe.
The exact sourcing is less important than the pattern. Once your identity, address, and crypto exposure are linked, the risk does not expire.
France was not a one-off
Balland was not alone. France has seen a run of attacks on crypto holders and executives since 2020. Police created a dedicated unit for crypto kidnapping and extortion. Cases include:
| Year | Target | Method | Outcome |
|---|---|---|---|
| 2021 | French crypto holder, Paris | Home invasion, forced to transfer crypto | Arrested after social media trail |
| 2022 | Bitcoin trader, Lyon area | Kidnapping, beaten, ransom demand | Released after partial payment |
| 2023 | Multiple victims, various | Extortion letters citing Ledger dump | No arrests - widespread campaign |
| 2024 | David Balland, Ledger co-founder | Kidnapping, torture, ransom | 10 arrested; Balland recovered |
| 2024 | Crypto exchange employee, UK | Family targeted for co-owner location | Ongoing investigation |
France is not unique. Similar attacks have hit the Netherlands, the UK, Germany, and parts of Eastern Europe. The common factor is simple: attackers had data that tied real people to crypto.
Why buying direct is risky
Buying a hardware wallet from the manufacturer is not privacy-neutral. You hand over:
- Your real name
- Your home address
- Your email address and phone number
- Proof that you own or plan to own crypto
- Payment information, if you use a card
That data sits in systems that can be breached, subpoenaed, or mishandled. Ledger was the loud warning. The basic risk applies to the whole category.
How to buy hardware with less exposure
The rule is blunt: do not give a hardware wallet company your home address if you can avoid it. Better options, in order:
- Buy in cash from a reseller - many electronics stores carry Trezor or Ledger devices. Pay cash. Check that the device is sealed and unmodified.
- Ship to a P.O. box or mail-forwarding service - use a throwaway email and a prepaid card loaded with cash.
- Ship to a friend or trusted address - your name may still appear, but not your home.
- Buy secondhand - only if it is factory sealed and you verify the firmware on first boot.
The risk stays
The Ledger dump never disappeared. It was posted in 2020 and mirrored, archived, and shared ever since. If your record was in that file, it is still circulating.
That is how breach exposure works. The hack happens once. The risk stays open. If your holdings grow, the value of that old record grows with them.
If you were in the Ledger dump, act like your old address is public. Use a P.O. box for correspondence. Do not talk about holdings. Harden your home. That sounds severe until you look at what already happened.
What Ledger got wrong, and what others still do
Ledger's core mistake was retention. It kept shipping addresses in an operational database after orders were done. That is normal in e-commerce. It is still a liability.
Since then, Ledger has upgraded parts of its security stack. It also launched Ledger Recover in 2023, a service that shards and stores seed phrases with identity-verified third parties. The backlash was immediate. Many users saw the same instinct again: collect more sensitive data, not less.
Other hardware wallet makers sell through the same e-commerce model. The brands change. The exposure does not.
Follow the money
Ledger SAS raised €380M from Sequoia and others at a €1.3B valuation. That growth pressure helps explain Ledger Recover, a paid seed-phrase custody product that asks for passport scans from users whose address data had already leaked.