Fake Ledger firmware update targets users after $86M spyware hack
Phishing campaign exploits Ledger spyware fears
Phishing scammers are launching a fake "Ledger firmware update" campaign, taking advantage of the panic surrounding a recent $86 million spyware scandal involving the hardware wallet maker.
Blockchain security firm SlowMist flagged the scam on X (formerly Twitter) on October 16, sharing screenshots of an email that urges recipients to connect their device to "protect your device against emerging spyware threats, such as recent incidents in Malaysia."
The email leads to a fake "Genuine check" page with a device selection menu and an "Update Now" button. SlowMist warned users to never click website links to update and to never enter their recovery phrase.
What the campaign looks like
- Fake firmware update emails referencing recent spyware incidents in Malaysia
- Phishing page mimicking a "Genuine check" with device selection and "Update Now" button
- Not yet listed on Ledger's official ongoing phishing scams webpage
The $86 million spyware scandal behind it
Last week, reports emerged of a mass-draining of Ledger devices, which was linked to authorized Southeast Asian reseller CryptoBilis. The company's former CEO, Arravind Prabu, stated the firm was "acquired earlier this year" under a confidentiality agreement lasting until October 19.
After the change in ownership, former Mt. Gox CEO Mark Karpelès found devices fitted with spyware that tapped into the display unit and transmitted data via a hidden SIM card.
The operation resulted in approximately $86 million in crypto being drained. Unconfirmed reports have suggested the spyware may have spread beyond Southeast Asia. German reseller MediaMarkt suspended sales, and Ledger has urged other distributors to do the same, though no source confirms the full geographic reach of affected devices.
Ledger CEO faces backlash for sharing post about scammer victim
Crypto forensics firm Chainalysis reported that one of the largest victims of the draining campaign was itself a "task scam" operator, who lost more than 60 BTC (about $4.8 million). The funds were proceeds from a scam in which people were paid to fake sales and reviews before being tricked into sending money to withdraw payments.
Ledger CEO Pascal Gauthier shared Chainalysis' post, drawing criticism. Some users accused him of lacking self-awareness, called for his resignation, and said Ledger deserved to go bankrupt.
Ledger launches new device amid crisis
Despite the ongoing turmoil, Ledger announced a new device called the Atom on October 15. The phone-like Android device includes a data-only eSIM and cannot make calls. It was priced at $849, drawing criticism from some users given the recent security failures.
Key takeaways for users
- Never click links in emails or messages to update your wallet firmware
- Always download updates directly from Ledger's official website
- Never enter your recovery phrase on any website
- Verify any firmware update announcements through official Ledger channels
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.
Related Posts
Bitcoin Drops Below $77,000 as Inflation Data Sparks Rate Hike Fears
Pixelmon Ends Game Development After Publisher Test Falls Short
