The "free upgrade" letter that arrives by mail

Illustrative scenario: a wallet owner receives an official-looking letter and an unsolicited replacement device. The enclosed instructions say to enter an existing 24-word recovery phrase to "migrate funds." If the device or linked setup flow captures those words, the attacker can control every account derived from that phrase. The scenario has no real date, city, customer or stated loss.

The physical-mail layer of attack

Physical mail can borrow a brand name, accurate personal details and professional packaging to look credible. Ledger's official phishing-status page tells users to treat an apparent Ledger communication received by postal letter as phishing and never enter the 24 words anywhere other than directly into their device.

The four rules

  • Do not initialize an unsolicited device. Confirm any replacement through a support channel you opened from the manufacturer's website. Trezor's device-safety guidance says to buy through its official shop or authorized sellers, inspect the package and let the official setup verify the device.
  • The 2020 leak is years old. A letter that suddenly cites it to justify a device swap is using the leak as a prop. Ledger's response to the leak was notifications and warnings to customers, not a program that mails out replacement devices.
  • Never restore your seed onto a device you did not buy yourself. Restoring a seed onto a genuine device you ordered from the manufacturer is normal, and the words go in on the device itself, never on a computer or phone. Doing the same on a device that showed up in the mail hands your seed to whoever built it. And if you really believe the old seed is at risk, the answer is a brand-new seed, not a transcribed one.
  • Verify any "official communication" through the manufacturer's website. Type ledger.com yourself and look for the program in Ledger's official announcements and support pages. Do not use any URL, QR code or phone number printed on the letter. If you cannot find the program there, the letter is fake.

If you used the fake device

Treat a recovery phrase entered into an untrusted device or flow as compromised. Stop using it, create a new phrase on a device obtained and verified through an official channel, and prioritize moving remaining assets to addresses derived from the new phrase. The order and method can depend on the assets and whether an attacker is already active; use the manufacturer's official support if you need incident-specific steps.