'Convincing' Phishing Attack Targets Ledger Hardware Wallet Users

Ledger confirmed that for the last week some customers have been the target of a phishing attack.

AccessTimeIconOct 27, 2020 at 8:13 p.m. UTC
Updated Sep 14, 2021 at 10:24 a.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global hub for everything crypto, blockchain and Web3.Register Now

Customers of Ledger, the hardware cryptocurrency wallet, are being targeted by a phishing attack posing as an email from Ledger support. 

On Sunday a Reddit user posted in the r/ethfinance subreddit, alerting the group to the existence of the attack. 

The fake email ostensibly informs users their Ledger assets may be compromised. It states, “Our forensics team has found several of the Ledger Live administrative servers to be infected with malware.” This claim is false; while the email form looks professional, it is a phishing attempt to steal customers data. 

The email is so convincing that even wary users might be fooled. Ledger confirmed that, for the last week, a phishing attack has been targeting Ledger cryptocurrency wallet customers. 

“I received the same email and for once I got really confused. Everything checks out,” said one Reddit user in reply to the original post. “However, there you can see that the url is incorrect (notice the dot on the second 'e' => ledgėr). What triggered my doubt was that I received the email twice within a couple of minutes. ... It's probably related to the previous hack where a hacker managed to get our email addresses.”

Another user replied, “Wow this looked really legit, so much so I used Contact Us form to ask Ledger if it was real. I am normally pretty good at sniffing things like this out – this was by far the most convincing attempt I have ever seen.”

Roots of a phishing attack

In July, the Ledger team discovered an API key related to their e-commerce and marketing database was exploited, and the database accessed by an unauthorized third party. The database details (mostly email addresses) were used to send order confirmations and promotional emails. 

In a blog post revealing the hack, the Ledger team emphasized that users' payment information and crypto funds are safe.

CoinDesk independently reviewed one of these phishing emails, which was sent from "support@legder.com." A key clue in any phishing email is a slight misspelling of a real address or URL; in this instance, “ledger.com” is misspelled. 

SingleQuoteLightGreenSingleQuoteLightGreen
Pro tip: Bookmark verified sites where you normally would input sensitive information and only access them through that bookmarked link.
SingleQuoteLightGreenSingleQuoteLightGreen

Phishing attacks are common and attackers are increasingly sophisticated, creating emails that resemble official company correspondence. They rely on a person making a mistake and clicking on a link that could compromise his or her security. 

In a statement, a Ledger spokesperson said an internal task force has been deployed to investigate the latest phishing attack. 

“The investigation is ongoing and at this time we cannot give any additional information but one thing is for certain: Ledger will never ask you for your 24-word recovery phrase, which is a blatant sign of a phishing scam,” said the spokesperson. “Ledger encourages customers to exercise caution as phishing attacks become more sophisticated and to alert Ledger's customer support team and consult Ledger.com for more information on the detection of scams.”

UPDATE (November 2, 2020, 17:46 UTC): Multiple Ledger users have shared that they are also being targeted by SMS phishing attacks, sent to their phones. CoinDesk has seen three separate examples of this phishing text below.

An example of a phishing text sent to a Ledger customer.
An example of a phishing text sent to a Ledger customer.

This is a phishing attempt and customers should not click on the link. The development further highlights customers concerns about how data stemming from the Ledger hack earlier this year is being used. 

UPDATE: November 2, 2020 (19:56 UTC) Ledger responded with the following comment:
"As soon as we discovered the data breach on Ledger's website in July 2020, we immediately patched it. Since then, we led two penetration tests with a third-party consultancy to verify and improve the security of our clients' data. For two weeks, some of Ledger's customers have been experiencing continuous phishing scams through various channels, including email and SMS. We've issued several scam alerts through our Twitter, email, and other channels to notify our users during the past two weeks.

The internal task force is investigating these attacks, and as of now, we can't state that scammers are using Ledger's marketing database, and therefore, these attacks resulted from July's data breach."

Disclosure

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.


Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.