The "firmware update" email
March 2025. A holder in Seattle receives an email from [email protected] with the subject "Critical security patch — action required within 24 hours." The email is well-formatted, includes the Ledger logo, references the 2020 customer-data breach (which is public information), and links to a "firmware update tool." The tool asks for the 24-word recovery phrase to "verify device ownership before patching."
The phrase goes in. Within 40 minutes, the wallet is drained.
The long tail of the Ledger leak
In 2020, attackers got into Ledger's e-commerce and marketing database. That December the data was dumped publicly on a hacker forum, including roughly 270,000 records with names, postal addresses, and phone numbers. Years later, that list still circulates, and scammers still send targeted phishing emails to the people on it. If you bought a Ledger from the official store before 2021, assume your details may be on it.
The three rules Ledger states explicitly
- Ledger Live never asks for your 24 words on a screen. The seed phrase is entered only on the device itself, using the device buttons. Any computer screen, browser tab, or email link asking for those words is a scam, 100% of the time.
- Firmware updates happen inside Ledger Live. Not via an email link. Not via a downloaded tool. Open Ledger Live, go to My Ledger (formerly Manager), and available updates show up there.
- Ledger does not email you with security urgency. Marketing emails, yes. "Patch in 24 hours or your funds are at risk" emails, never.
What the email actually wants
The phishing site is a clone of ledger.com sitting on a lookalike domain — ledger-security.com, ledger-live-app.com, ledgerwallet-support.com. Hover before clicking. If the domain is not ledger.com itself (or a subdomain that ends in .ledger.com), it is a scam.
What I do with these emails
Report to [email protected], then to Ledger's own phishing report address ([email protected]), then delete. Do not click "unsubscribe" — that just confirms the address is live.