Phishing scammers are exploiting the recent Ledger hardware wallet security crisis with a new campaign impersonating firmware updates. Blockchain security firm SlowMist flagged the scam, which sends emails urging recipients to connect their devices to "protect against emerging spyware threats."
The fraudulent emails reference recent incidents in Malaysia and direct users to fake pages mimicking legitimate Ledger interfaces, including device selection options and an "Update Now" button. The campaign does not currently appear on Ledger's official list of known phishing scams.
Background on the Ledger incident
Last week, reports emerged of mass draining of Ledger devices, traced to authorized reseller CryptoBilis operating in Southeast Asia. After the company changed ownership earlier this year, spyware was discovered on devices, with data transmitted via a hidden SIM card. The operation resulted in approximately $86 million in cryptocurrency losses.
Following the discovery, European retailer MediaMarkt suspended Ledger sales, and the company urged other distributors to do the same.
Scammers among the victims
According to crypto forensics firm Chainalysis, one of the largest victims of the mass draining was itself a scam operator. More than 60 BTC, valued at approximately $4.8 million, were drained from three compromised devices. The funds were proceeds from a task scam in which people were paid to fake sales and reviews of real items, then tricked into sending money to withdraw their payments.
Ledger CEO Pascal Gauthier's decision to share the Chainalysis findings on social media drew criticism, with some social media users calling for his resignation.
