Ledger Discord moderator account hijacked to phish recovery phrases

Late on 10 May 2025 an attacker used the compromised account of a contracted moderator to take over part of Ledger’s Discord server, according to The Block. Cointelegraph reports that the attacker told members about a supposedly newly discovered vulnerability in Ledger’s security systems and urged them to verify their recovery phrases through a link, where they were asked to connect their wallets and follow on-screen instructions. A bot posted scam links in one channel.

Community members said on X that the attacker used moderator rights to ban or mute users who tried to warn others; Cointelegraph notes these were community claims.

Ledger team member Quintin Boatwright said that a contracted moderator’s account had been compromised and that the account was removed, the bot deleted, the website reported and all relevant permissions reviewed and secured. He described it as an isolated incident and said Ledger had added further Discord security measures. The Block reports that Ledger regained control on 11 May and that the scam site appeared to be down by that morning.

What Ledger advises:

• Never enter your recovery phrase or connect your wallet via a Discord link.