Ledger, Again: Another Attack, Another Phishing Wave: How Can Users Protect Themselves?

In Hacks and security Wallets and custody

Phishing activity around Ledger continued with a fake firmware-update message aimed at hardware-wallet users, and one security firm flagged screenshots of the lure. Another report said German stock inspections found no tampering, while Ledger had not verified a drain linked to a device bought outside Southeast Asia. A separate report said Ledger said its authenticity check cannot detect added hardware.

Share on X Share on Telegram Share on Reddit Share on WhatsApp

What this rests on

Claim by claim, with its source

✓

German stock inspections in Germany found no tampering, and Ledger had not verified a drain tied to a device bought outside Southeast Asia.

Karpelès Reports Ledger Implants in Devices From Two More Resellers

✓

Ledger said its authenticity check cannot detect added hardware.

Karpelès Reports Ledger Implants in Devices From Two More Resellers

✓

A phishing campaign used a fake firmware-update message aimed at Ledger hardware-wallet users, telling them to connect their device to protect it against spyware threats.

Phishing scammers capitalise on Ledger panic with fake firmware update

✓

The email screenshots shared by SlowMist referred to recent incidents in Malaysia as part of the lure.

Phishing scammers capitalise on Ledger panic with fake firmware update

What it means

Who it affects, what changes and what is still unconfirmed

Each sentence links inside to the piece that supports it.

Users with Ledger hardware wallets are the clearest people affected today, because a new phishing message is trying to get them to connect their device and follow a fake update path. Security teams and wallet holders also have a new lure to watch for, including language that points to incidents in Malaysia and claims about spyware threats.

In practice, the check Ledger describes does not rule out extra hardware being added after a device leaves the normal supply chain. That means the situation is not just about one message or one inspection, and the earlier stopgap of relying on a simple authenticity check remains limited as described.

Market reaction

BT Bitcoin market event: it is read against the reference from 2 h before to 4 h after the line marks the first headline

-0.41 % before publication

-0.23 % after

$81,936price at publication

11series points

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.

How the story was built

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.