Fake Ledger Nano X devices mailed to data breach victims

In June 2021 a Reddit user reported receiving a package with what looked like a Ledger Nano X in shrink-wrapped, authentic-looking packaging. According to BleepingComputer, the enclosed letter said the device was a replacement because the customer’s information had leaked online — plausible, since Ledger customer data had been published in December 2020. According to Cointelegraph, the letter claimed to be signed by Ledger’s CEO.

Photos of the circuit board showed the device had been modified. Security researcher Mike Grover told BleepingComputer it appeared to be a flash drive attached to the Ledger and wired to the USB connector for malware delivery. The instructions told the recipient to connect the device, run an application from the drive and enter the recovery phrase, which would be sent to the attackers.

Vice reports that Ledger co-founder Nicolas Bacca confirmed on Reddit that the device was fake. Cointelegraph and BleepingComputer report that Ledger had warned about the scam in May 2021. The devices were counterfeits built by attackers and mailed unsolicited, not genuine units tampered with in Ledger’s distribution.

What to do:

• Never share your recovery phrase; enter it only on the Ledger device you are recovering.
• Do not connect a device you did not order.
• Download Ledger Live only from ledger.com.