Scammers have begun sending out fake hardware wallets to Ledger customers in an attempt to steal the cryptocurrency (opens in new tab) from their Bitcoin wallets. (opens in new tab)
According to a new report (opens in new tab) from BleepingComputer, a Reddit user who goes by the handle 'jjrand' recently made a post on the site (opens in new tab) explaining how they had received a Ledger Nano X (opens in new tab) hardware wallet in the mail. The shrink-wrapped package was emblazoned with the company's logo to make it appear more legitimate and contained an installation manual.
- We've built a list of the best data loss prevention (opens in new tab) services available
- These are the best password managers (opens in new tab) on the market
- Also check out our roundup of the best identity theft protection (opens in new tab)
However, the package jjrand received, which they didn't place an order for with the company, also contained a letter from Ledger CEO Pascal Gauthier that explained the replacement device was sent out following a data breach that led to customer information being exposed on a popular hacking forum, which read:
"For this reason for security purposes, we have sent you a new device you must switch to a new device to stay safe. There is a manual inside your new box you can read that to learn how to set up your new device. For this reason, we have changed our device structure. We now guarantee that this kinda breach will never happen again.”
After experiencing a data breach (opens in new tab) in July of last year, Ledger customers have been the target of multiple phishing campaigns launched by cybercriminals and scammers.
For instance, in December of 2020, the company's customers were targeted by a phishing campaign which used fake data breach notification emails (opens in new tab) to try and convince Ledger users to download the Ledger Live app. While the mobile version of the app in the links included in these emails was real, the desktop version wasn't and if a user installed it, the app would prompt them to enter both their recovery phrase and secret passphrase in order to gain access to their wallet and steal their crypto.
These ongoing phishing campaigns have become so frequent that Ledger created a list on its website (opens in new tab) to keep track of them all. In a statement to TechRadar Pro, the company's chief information security officer Matt Johnson provided further details on this latest scam, saying:
“We are aware of this scam, which we have included in our list of ongoing malicious attacks listed on our website. You should be suspicious of receiving a free product in the mail that you didn’t order and check Ledger’s official channels or contact Ledger support team. Ledger and Ledger Live will never ask you to share your 24-word recovery phrase. Finally, Ledger communicates securely through Ledger Live, never by mail or phone. We would never mail anything to your address without your consent.”
Ledger customers should remain vigilant in order to prevent falling victim to this most recent scam as well as others designed to steal their cryptocurrency.
- We've also highlighted the best security key (opens in new tab)
Via Vice (opens in new tab)