To avoid fake Ledger devices and phishing scams, buy directly from Ledger, run the Genuine Check in Ledger’s official app, and never type your 24-word recovery phrase anywhere except on the d
To avoid fake Ledger devices and phishing scams, buy directly from Ledger, run the Genuine Check in Ledger’s official app, and never type your 24-word recovery phrase anywhere except on the device itself.
October 2026 added one more step. Inspect the device before setup, because some tampered units pass Ledger’s software check.
That change follows a major supply chain attack. Since October 9, buyers of Ledger devices from CryptoBilis, an authorized reseller in Malaysia, Indonesia and the Philippines, have watched their wallets drain.
The attack did not break Ledger’s security chip. It went around it.
Ledger’s security lab, Donjon, explained on October 13 that the implant sits inside the device case and reads the screen. When the device shows the recovery phrase during setup, a microcontroller decodes the words and sends them out over a mobile network using an eSIM.
On-chain researchers estimate losses of up to $93.2 million across about 300 wallets. Ledger has not confirmed the total number of affected users or the value lost.
The scare spread to Europe. MediaMarkt Saturn paused Ledger sales after a customer in Germany reported an implant. According to Ledger, no funds were lost in that case, and it has not confirmed whether the European reports are linked to CryptoBilis. On October 15, Ledger introduced new security requirements for its authorized retailers.
Former Mt. Gox CEO Mark Karpelès said tampering reports date back to at least December 2025, and he urged Ledger to warn customers more proactively.
There are two kinds of bad devices, and they need different checks.
A counterfeit is a copy made to look like a Ledger. In April 2026, a researcher bought a fake Nano S Plus on a Chinese marketplace at the official price. Its chip markings were scraped off, it contained a WiFi and Bluetooth antenna that genuine units lack, and a QR code in the box led to a cloned site serving a trojanized Ledger app. A trojanized app looks real but hides malicious code.
A tampered device is real Ledger hardware modified after it left the factory. Ben Yorke, who works in crypto, noticed markings on a Ledger Flex he bought at Singapore’s Changi Airport suggesting someone may have tried to pry it open. Karpelès examined it and found a custom connector tapping the display, plus a cellular chip and SIM card. Ledger has not confirmed that device is linked to the same incident.
Stop and contact Ledger Support if you see any of these:
Many buyers check that the plastic shrink wrap around the box is unbroken, since an intact seal usually suggests the box has not been opened since the factory. In 2026, that check is no longer enough.
Karpelès said his tampered device arrived in intact shrink wrap, which means attackers were able to reseal boxes after modifying the device inside. Ledger offers a guide to inspect the inside of a device, but warns that opening it can cause damage and to back up your recovery phrase first.
It works against counterfeits, but not against every implant.
The Genuine Check confirms that the Secure Element, Ledger’s tamper-resistant chip, is authentic. Genuine Ledger devices hold a secret key set during manufacture, and only a real device can produce the matching cryptographic proof. The April counterfeit failed the check when connected to a properly installed Ledger app.
Implanted devices are different. Because the original chip is intact, tampered units still pass the Genuine Check.
Phishing scams try to trick you into giving up your recovery phrase yourself. Anyone holding that phrase can rebuild your wallet on another device.
On October 16, security firm SlowMist flagged emails urging Ledger owners to connect their wallets to guard against spyware threats like the Malaysian incident. The fake page copies Ledger’s Genuine Check screen and update flow, then asks for all 24 recovery words. Ledger says to update devices and Ledger Wallet only through official Ledger channels.
Scammers also use postal mail. One Ledger-themed letter claimed a “Transaction Check” would become mandatory and told users to scan a QR code by October 15, 2025. These letters appear linked to Ledger’s 2020 data breach, which exposed details of over 270,000 customers, including home addresses.
Typosquatting means registering domains that look like real ones. On October 25, monitoring service PhishDestroy flagged algledger.net as a Ledger impersonation page.
Act before moving any more funds.
Ledger’s Genuine Check detects counterfeit hardware, and the device screen remains the only safe place to enter a recovery phrase. Buying directly from Ledger, inspecting the case before setup and ignoring update links in emails or letters block the most common attacks seen in 2026.
