Ledger SAS is facing a putative class action in New York over a December 2023 compromise of the NPMJS account used to publish its Connect Kit software library. Douglas Kim alleges that fallout from the incident helped identify him as a Ledger customer and facilitate a February 2025 impersonation scam that caused a $1,948,074 cryptoasset loss. Ledger CEO Pascal Gauthier stated that the incident was isolated to third-party applications and that Ledger hardware wallets remained unaffected, with estimates at the time placing losses from the Connect Kit exploit between roughly $480,000 and $600,000. Ledger later said it would reimburse affected users and announced plans to phase out blind signing for Ethereum virtual machine decentralized applications. The new lawsuit goes beyond those initial losses. Plaintiffs further contend Ledger downplayed the incident’s severity, failed to disclose it in a timely manner, and that exposed customer contact data was later used in Ledger impersonation schemes and circulated on darknet and black markets, while also citing the company’s 2020 customer-data leak as evidence of a broader security pattern. The complaint, filed Aug. 27, 2026, in the U.S. District Court for the Southern District of New York, seeks at least $500 million across multiple causes of action including New York business-law claims, negligence, and negligent misrepresentation, and estimates a nationwide class of up to 210,000 people. The alleged link between the 2023 software compromise and Kim’s later loss is pleaded on information and belief, with the right reserved to amend after discovery of Ledger’s incident-response records.