Ledger scams
Last updated September 18, 2026
The short answer
Every Ledger scam reduces to one request: your 24-word recovery phrase. Ledger will never ask for it — not by email, not in Ledger Live, not on a support call, not to "validate" or "migrate" your wallet. Anyone who asks is stealing from you, and there are no exceptions.
Ledger owners are targeted with unusual precision because of a specific event: in 2020 a customer database containing around 270,000 names, addresses, phone numbers and emails was leaked. Scammers know who owns a hardware wallet and where they live, which is why Ledger phishing is personalised, persistent, and occasionally physical — fake replacement devices have been posted to real customers at their real addresses.
How Ledger scams work
- 1
Recovery-phrase phishing
An email or text warns of a breach, a required firmware update, or a compromised device, and links to a page asking you to enter your 24 words to "verify" or "restore". Entering them anywhere other than the device itself hands over everything.
- 2
Fake replacement devices in the post
A package arrives with Ledger branding, a convincing letter about a security incident, and a device with instructions to enter your existing recovery phrase. The device is modified to transmit it. This has been sent to real customers at addresses from the leak.
- 3
Fake Ledger Live applications
A search ad or link leads to a counterfeit Ledger Live download. The application looks correct and asks for the recovery phrase during "setup".
- 4
Support impersonation after a public post
Post a Ledger question anywhere public and expect DMs offering help within minutes, all of which lead to a phrase request.
Warning signs
- Anything at all asks for your 24-word recovery phrase
- An email about a Ledger breach, update or migration includes a link
- A Ledger device arrives that you did not order
- A "support agent" messages you first after you posted publicly
- A download comes from anywhere other than ledger.com
- You are asked to enter your phrase into a computer or phone rather than the device buttons
- The message creates urgency — funds at risk, act within 24 hours
Examples
The replacement device in the post
A customer receives a sealed Ledger-branded box with a letter explaining that their device is affected by a vulnerability and must be replaced. The included device prompts for the existing 24 words during setup. The hardware was modified; the phrase was transmitted the moment it was entered, and the wallet emptied that evening.
Firmware update that was not
An email headed "Critical: Ledger Live update required" links to a convincing download page. The installed application is a clone that asks for the recovery phrase during initialisation. $61,000 in assets moves out in a single transaction nine minutes later.
What to do
- Never type your 24 words into any computer, phone or website. They are entered on the device buttons only, and only when you set up or restore it yourself.
- Download Ledger Live only from ledger.com, typed directly into the address bar.
- Ignore any unsolicited device, letter or email, no matter how convincing the branding.
- Treat every email about Ledger as phishing by default. There is essentially no legitimate email that needs you to click anything.
- If you entered your phrase anywhere, move your assets to a brand-new wallet immediately — the old one is permanently compromised.
Report it to Ledger
Report phishing at support.ledger.com. Ledger never asks for your 24-word recovery phrase, in any channel, for any reason.
Getting your money back
A recovery phrase that has been entered anywhere is burned permanently — there is no changing it, so the only response is to set up a new wallet with a new phrase and move everything that remains, immediately, before the attacker does. Funds already gone are almost never recoverable; report to IC3 with transaction hashes in case the destination is an exchange that can freeze them. Expect continued targeted phishing for years, because the leaked customer list does not expire.
Frequently asked questions
Will Ledger ever ask for my 24-word recovery phrase?
Never, under any circumstances. Not support, not Ledger Live, not a firmware update, not a security check. The phrase is entered on the device's own buttons when you set it up or restore it, and nowhere else. This single rule defeats every Ledger scam that exists.
Why do I get so much Ledger phishing?
A 2020 leak exposed around 270,000 Ledger customer records including names, addresses and phone numbers. Scammers know you own a hardware wallet and where you live, so the phishing is personalised and does not stop. Treat every unsolicited Ledger contact as hostile.
I received a Ledger device I did not order. What should I do?
Do not connect it or use it. Modified devices have been posted to real customers using addresses from the leak, with a letter explaining why you need to "migrate" your phrase to it. Report it to Ledger support and dispose of it.
Other companies scammers impersonate
Scams reuse their scripts across brands. If you were contacted about Ledger, these are the guides worth reading next.