Crypto Security Breach: Ledger Users Face Sophisticated Attack

Mila Mostovaya

Security
Crypto Security Breach: Ledger Users Face Sophisticated Attack

Scammers have come up with a new way to steal your crypto assets. Hard to believe, but this is an offline method to leak sensitive information from cold wallets. The first victims were Ledger users. In this article, we are going to talk about how it works.

Key Takeaways

  • Scammers sent fake letters on behalf of Ledger, urging users to “validate” their wallets via QR codes — a trick used to steal private keys.
  • Always stay alert and review the privacy policy of every service you use.
  • Coin Wallet will never ask you to share personal or sensitive information. Our official support email is support@coin.space.

What Happened?

Recently, some Ledger users began receiving fake letters that appeared to come from Ledger. The message urged them to “validate” their wallets or risk losing access to their funds. To do so, users were asked to scan a QR code — likely linked to a phishing site designed to steal private keys.

BitGo CEO Mike Belshe was among the first to flag the attack and share it on his X.com account. Some users later confirmed they had received the same letters. It turned out the scammers had sent them through the United States Postal Service (USPS).

CoinSpace
X.com
CoinSpace
X.com

What Should You Do? Some Recommendations

Some experts believe this incident marks the first shift in tactics — from digital to physical social engineering. That is why you should stay especially alert. And remember, this could happen with any service, not just Ledger. So we want to give some recommendations on how to act in situations like this.

  1. Always read the privacy policy of any service you use. This helps you understand when and why a service might request access to your personal data — for example, for KYC purposes — or when it should not.
  2. Coin Wallet will never ask you to send us any sensitive information. We also never send printed letters or emails asking you to “validate” your account. Our official email address is support@coin.space.
  3. We have collected more recommendations in our anti-scam article — Crypto Scams: How to Stay Safe Online. Please take a moment to read it — it might be really useful.