Security firm SlowMist warned on 16 October of a phishing campaign that copies Ledger's firmware update screens, including its "Genuine Check" and an "Update Now" button, and ends by asking for the 24-word recovery phrase. Separately, a German Ledger owner reported a posted letter in Ledger branding saying wallets must be registered through ZenLedger by 31 October, with a QR code to scan. Both lean on fear after Ledger confirmed spy implants in some resold devices. Ledger says it never asks for a recovery phrase.

Why now

Earlier this month Ledger confirmed that some devices sold through one Southeast Asian reseller, CryptoBilis, carried implants that stole recovery phrases. On 13 October, MediaMarktSaturn stopped selling Ledger devices in its stores and online, with Ledger's agreement, after a German customer reported a suspect device. Ledger says its own systems weren't breached. Scammers use worried owners as their opening.

Scam 1: the fake firmware update

Per SlowMist, the fake pages copy Ledger's device check and update flow step by step. Some reports say people are being sent there by emails claiming the update protects against spyware. The last step asks for your 24-word recovery phrase. Anyone who types it in hands over the wallet. SlowMist said it couldn't yet say how many people were targeted or whether any money was lost.

Scam 2: the posted letter

The letter uses Ledger branding, mentions Germany's financial regulator, and claims new rules require Bitcoin wallets to be registered through ZenLedger by 31 October. A QR code leads to the "registration". No such rule exists, and nothing suggests ZenLedger itself is involved: its name is just being used. Similar letters, including a fake "quantum security update", have reached Ledger and Trezor owners since at least April. They appear to use addresses leaked in Ledger's 2020 customer data breach.

How to stay safe

  • Only update firmware inside the official Ledger Wallet app on your computer or phone, never from a link in an email, text or letter.
  • Never type or scan your recovery phrase into any website, app or form. Ledger says it never asks for it.
  • Throw away letters with QR codes that ask you to "register", "verify" or "migrate" a wallet.
  • Already typed your phrase somewhere? Move your crypto to a new wallet with a new recovery phrase right away. Our Ledger implant guide shows how to do it safely.
  • Not sure about a message? Run it through our 2-minute scam check.

Sources: SlowMist alert, 16 Oct 2026, Protos, The Crypto Times, Cointelegraph: scam letters, Cointelegraph: MediaMarkt pulls Ledger.