Ledger confirmed today that a letter claiming to be from the crypto wallet’s security team is a scam, and warned users to ignore it and keep their crypto wallet recovery phrases to themselves.
The company was responding to crypto trader Jacob Canfield, who shared the scam letter on X yesterday. Canfield claims the scammers are “sending physical letters to the @Ledger addresses database leak requesting an ‘upgrade’ due to a security risk.”
It claims to be from Ledger’s “Security and Compliance” and asks users to give up their recovery phrase in response to a “critical security update.”
“Failure to complete this mandatory validation process may result in restricted access to your wallet and funds,” the scam document reads.
Ledger admits impersonation scams are “common”
In response to the post, Ledger warned, “Scammers impersonating Ledger and Ledger representatives are unfortunately common.”
It reminded users, “Always remember: Ledger will never call, DM, or ask for your 24-word recovery phrase. If someone does, it’s a scam. Stay cautious and keep your crypto safe.”
This isn’t the first physical scam Ledger has seen. In 2021, after suffering a leak a year earlier, Ledger users began receiving Ledger devices in the mail that were tampered with and designed to install malware upon use.
This letter appears to utilize the same Ledger leak and has likely taken advantage of the stolen emails and addresses of 270,000 Ledger users that were published online. Ledger has also suffered from supply chain attacks and phishing campaigns over the years.
However, as Canfield noted, Ledger might need to update their warning to include letters alongside DMs and calls.