Ledger Phishing Scams Targeted by Fake Firmware Update
Key Summary
Phishing scammers are taking advantage of the recent Ledger supply chain incident, capitalizing on the fear and panic by sending fake firmware updates to users. The scammers aim to steal recovery phrases and other sensitive information from Ledger devices. Users are advised to be cautious and not click on suspicious links or enter their recovery phrases.
Precedent & Market Context
The recent Ledger supply chain incident has raised concerns about the security of the wallets and the broader cryptocurrency market. In July, Ledger confirmed that devices sold by CryptoBilis contained hidden cellular implants designed to steal recovery phrases.
The Fake Firmware Update Scam
Phishing scammers are now capitalizing on the Ledger panic with a new fake firmware update phishing campaign. Blockchain security firm SlowMist flagged the scam, sharing screenshots of an email that urges the recipient to connect their hardware wallet to "protect their device against emerging spyware threats, such as recent incidents in Malaysia." The campaign doesn't currently appear on Ledger's own "ongoing phishing scams" webpage, which instead warns of campaigns linked to previous data leaks.
The Impact of the Scam
The fake firmware update scam is a common tactic employed by scammers looking to take advantage of the fear created by such incidents. The campaign has already claimed a total of $86 million in crypto, with one of the largest victims being a "task scam" operator who lost more than 60 BTC, about $4.8 million.
The Importance of Security
The Ledger supply chain incident highlights the importance of custody and supply chain security in the cryptocurrency industry. Users are advised to be cautious and not click on suspicious links or enter their recovery phrases. Ledger has confirmed losses remain limited to Southeast Asia, and European spot-checks found no tampered stock.
The Response
Ledger has announced a new device, the phone-like Atom, which is an Android device fitted with a data-only eSIM, which cannot make calls. The company has also urged other distributors to suspend sales of Ledger devices. Crypto forensics firm Chainalysis has also shared information about the scam, stating that one of the largest victims was a task scam operator who lost more than 60 BTC, about $4.8 million.
Conclusion
The fake firmware update scam is a serious threat to the security of Ledger devices and the broader cryptocurrency market. Users are advised to be cautious and not click on suspicious links or enter their recovery phrases. Ledger and other companies must take proactive steps to address the issue and prevent similar incidents in the future.