hack or exploit

Ledger, Again: Another Attack, Another Phishing Wave: How Can Users Protect Themselves?

0Importance

closedStatus

3News media

3Pieces

Published: Oct 16, 2026 10:22 UTC
Updated: Oct 16, 2026 19:37 UTC
Since then: 2 new reports
In: Wallets and custody

Phishing activity around Ledger continued with a fake firmware-update message aimed at hardware-wallet users, and one security firm flagged screenshots of the lure. Another report said German stock inspections found no tampering, while Ledger had not verified a drain linked to a device bought outside Southeast Asia. A separate report said Ledger said its authenticity check cannot detect added hardware.

Share on X Share on Telegram Share on Reddit Share on WhatsApp

Key claims & sources

✓

German stock inspections in Germany found no tampering, and Ledger had not verified a drain tied to a device bought outside Southeast Asia.

Karpelès Reports Ledger Implants in Devices From Two More Resellers

✓

Ledger said its authenticity check cannot detect added hardware.

Karpelès Reports Ledger Implants in Devices From Two More Resellers

✓

A phishing campaign used a fake firmware-update message aimed at Ledger hardware-wallet users, telling them to connect their device to protect it against spyware threats.

Phishing scammers capitalise on Ledger panic with fake firmware update

✓

The email screenshots shared by SlowMist referred to recent incidents in Malaysia as part of the lure.

Phishing scammers capitalise on Ledger panic with fake firmware update

What it means

Users with Ledger hardware wallets are the clearest people affected today, because a new phishing message is trying to get them to connect their device and follow a fake update path. Security teams and wallet holders also have a new lure to watch for, including language that points to incidents in Malaysia and claims about spyware threats.

In practice, the check Ledger describes does not rule out extra hardware being added after a device leaves the normal supply chain. That means the situation is not just about one message or one inspection, and the earlier stopgap of relying on a simple authenticity check remains limited as described. (per thedefiant.io)

Market reaction i

Total crypto marketall crypto assets combined no single asset in the event: read against the whole market

-0.6% 2 h before

-0.2% 4 h after

$2.8Tmarket cap at publication

11data points

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.