Fraudulent actors are targeting cryptocurrency holders with deceptive emails claiming a critical firmware update is required for Ledger hardware wallets. This phishing campaign, identified by the security firm SlowMist, attempts to steal 24-word recovery phrases by mimicking official company communications .
The 24-word recovery phrase trap
The phishing operation relies on a high-fidelity imitation of the Ledger Team's branding to trick users into compromising their own security. According to SlowMist , the attackers send polished emails that warn users about rising spyware threats and unauthorized third-party applications, urging them to click an "Update Now" button to secure their assets.
Once a user clicks the link, they are directed to a fraudulent "Genuine check" page that mirrors the actual verification process used by Ledger . The page cynically mimics official advice by recommending that users only purchase devices through official channels, building a false sense of trust before finally prompting the victim to enter their 24-word recovery phrase. Once this seed phrase is entered, the attackers gain total control over the associated cryptocurrency wallet.
Leveraging the October 9 supply chain breach
This campaign is a calculated exploitation of a real-world security event. As SlowMist reported, the phishing wave began roughly one week after a legitimate supply chain incident involving Ledger on October 9. By timing the attack to coincide with a period of high user anxiety, the scammers transformed a genuine security concern into a believable pretext for their fraud.
This pattern reflects a broader trend in digital asset crime where attackers "piggyback" on actual breaches to lend credibility to their messages. when a company like Ledger warns its users to be vigilant and update their devices, a subsequent email requesting a security update feels like a logical next step rather than a red flag, making the social engineering far more effective.
Nano S Plus and Nano X users in the crosshairs
The scope of the scam is broad, specifically naming several popular hardware models to increase the likelihood of a hit. The fraudulent emails explicitly list the Nano S Plus, Nano X, Flex, Stax, and Nano Gen5 as affected devices requiring the fake security patch.
To counter this, Ledger has reiterated that the company will never request a 24-word recovery phrase via email, direct message , or phone call. All legitimate firmware updates for Ledger devices are handled exclusively through the official Ledger Live application installed on the user's own device, never through an external link provided in an email.
Who is behind the SlowMist-flagged campaign?
While the technical flow of the scam is well-documented, several critical details remain unknown. The SlowMist alert does not identify a specific hacking collective or state-sponsored actor responsible for the campaign, leaving it unclear if this is the work of a known syndicate or a new opportunistic group.
Additionally, there is currently no public data on the total volume of funds sotlen through this specific firmware-themed campaign. Because the source of the reporting is a threat intelligence alert rather than a forensic audit of stolen assets, the full scale of the financial damage remains unverified.
Comments 0