Ledger's supply chain incident has slightly cooled, and scammers are already cashing in. Blockchain security company SlowMist has issued a threat intelligence alert warning of a fake “Ledger firmware update” campaign that exploits the fallout from the October 9 CryptoBilis incident. Its advice is blunt: never click website links to update, and never enter your recovery phrase anywhere.
What Users Should Do
Ledger's position has not changed: it will never call you, DM you, or ask for your 24-word recovery phrase. Firmware updates are handled through the official Ledger Live app on your own device, not through links in emails. If a message pushes urgency, delete it. Anyone who entered a phrase into a domain like this should treat the wallet as compromised and move funds to a new device with a fresh seed immediately.
Built to Look Real
SlowMist says the campaign looks very real. Screenshots show a polished email posing as “The Ledger Team,” claiming a firmware update is available for your device. The trap is tailored to the moment. It says the update is essential to protect against rising spyware threats, citing recent incidents in Malaysia, unauthorized third-party applications, and potential fund theft.
The email lists affected devices: Nano S Plus, Nano X, Flex, Stax, and Nano Gen5. It promises improved protection against spyware and malicious apps, enhanced safeguards against unauthorized access, and important security patches. At the bottom sits a black “Update Now” button.
Clicking it leads to the next stage: a fake “Genuine check” page that imitates Ledger's real verification flow. It walks victims through device selection and even includes a message recommending purchases through Ledger's reseller network. This is a cynical borrowing of the exact advice users have been hearing since the incident. The final step is the one that matters: a prompt for your recovery phrase.
Why It Works
Phishers don't need to invent a story. Ledger has handed them one. Users have been told to check their devices, update compromised signers, and follow official guidance. A “security update” email arriving in the middle of that panic does not feel suspicious to many people. It feels like the next step. Ledger had warned that scammers might exploit the confusion around the incident. That prediction came true within about a week.