According to The Defiant, the Ledger SDK sends signing metadata by default, with the relevant reporting code including target addresses and device details. Ambire stated that it has not deployed the affected version to its production environment. The report describes metadata reporting and integration version handling; it does not establish that private keys have been uploaded or user funds stolen.