The case of the booby-trapped Ledger devices sold in Southeast Asia now has a sequel by email. According to Journal du Coin, a phishing campaign is pushing worried users toward a fake “firmware update”. The page imitates Ledger’s authenticity check, then asks for the recovery phrase. The alert comes from SlowMist, the security firm that had confirmed the pattern of the first implants. The takeaway is simple: nothing gets updated from a website.

The fake Ledger update scenario

The email is signed “The Ledger Team”. It announces a firmware fix against “spyware threats” detected in Malaysia and lists five affected devices: Nano S Plus, Nano X, Flex, Stax and Nano Gen5. The “Update Now” button leads to a page that reproduces the “Genuine check” Ledger performs in its app. The user selects their model, then is asked for their 24 words to “restore” or “sync” the device.

At this point, the game is lost. As Journal du Coin points out, whoever holds the recovery phrase can recreate the wallet on any device and empty it without ever touching the Ledger. The hardware implant discovered last week aimed for exactly this result: it read the 24 words on the screen during setup. The phishing achieves the same thing without a chip, by playing on fear. The domains used by the scammers had not been made public at the time of the alert.

An already serious affair

The context explains why the trap works. Since 9 October, hundreds of owners of Ledger devices bought from CryptoBilis, an authorised reseller in Indonesia, Malaysia and the Philippines, have seen their crypto disappear. Bitquery counts $102 million siphoned from 324 wallets across six blockchains, a figure verified as of 15 October that Ledger has neither confirmed nor disputed. Chainalysis even found that one of the biggest victims was a scammer himself, relieved of more than 60 bitcoins, or about $4.8 million.

Ledger speaks of a “highly organised criminal group” that opened genuine devices to graft components onto them, before putting them back into circulation through Southeast Asian resellers. The manufacturer stresses that the chip, the operating system and the servers remained intact: “it was a localised attack on distribution”, the company writes.

Why a recovery phrase is never entered online

Ledger’s guidelines, relayed by Journal du Coin, come down to a few rules. A firmware update is done only in the Ledger Wallet app (formerly Ledger Live), and each step is confirmed on the device’s screen. Ledger sends no email asking for an update. The 24 words are entered only on the device itself, never on a computer, a phone or a web page, and support never asks for them.

Ledger does not contact anyone by SMS, WhatsApp, Telegram, phone call or postal mail. The only legitimate domains are ledger.com, ledger.fr, ledgerwallet.com and ledger.zendesk.com: beware of variants such as “legder” or “leqder”. Never approve on the device a transaction you did not initiate. Finally, a Ledger cannot be disabled remotely, so any threat of blocking “for lack of verification” is a scam. SlowMist sums up the defence: never click a link to update, never enter your recovery phrase anywhere.

Checking your device and buying it through an official channel

A device’s authenticity is checked in the official app, not on a page received by email. Ledger recommends downloading Ledger Wallet only from shop.ledger.com and ignoring private messages on social networks. Fake accounts can be reported to @ledgerprotect on X.

When buying, it is better to go through an official channel. According to Ledger, checks carried out in stores and warehouses in Europe found no modified units. The manufacturer has suspended sales at its authorised resellers in Southeast Asia and Hong Kong, banned the resale of returned devices and requires stock to be kept in reserve until purchase.

For a device bought from CryptoBilis or another reseller in the region, Ledger asks owners not to set it up if it is still in its blister pack. If it is already in use, the instruction is to create a new wallet on a clean device, with a new recovery phrase, transfer the funds to it, then contact support only through the chat at support.ledger.com. The same rule applies to anyone who has already entered their 24 words on a suspicious page: the wallet should be considered compromised.

The product response will come later. The Ledger Atom, unveiled at 849 euros, will detect when its casing is opened, but it will not be released until summer 2027. Until then, protection comes down to one rule: the 24 words never leave the device.

Sources

  • Journal du Coin: “Ledger: a phishing attack exploits the spy implant affair”
  • Journal du Coin: “Booby-trapped Ledgers: a scammer loses 60 bitcoins”