Postal letters impersonating Ledger asked owners to enter recovery phrase

On 29 April 2025 crypto commentator Jacob Canfield posted on X a letter mailed to his home that appeared to come from Ledger. According to Cointelegraph and The Block, the letter used Ledger’s logo, business address and a reference number, claimed a mandatory wallet validation was needed for a critical security update, and told the recipient to scan a QR code and enter the recovery phrase. It warned that failing to complete the process might restrict access to the wallet and funds. Cointelegraph reports that a hardware wallet reseller had described multiple similar cases earlier that month.

heise online reported a further letter in June 2025, received by a reader, whose QR code led to renewledger.com, a domain registered about two weeks earlier. According to heise, the site imitated Ledger’s website and, after a CAPTCHA, asked for the 24 recovery words; entering them would let the scammers empty the wallet.

Ledger responded on X that scammers impersonating Ledger are common and that it will never call, send direct messages or ask for the 24-word recovery phrase. Canfield suggested the senders used addresses from Ledger’s 2020 customer data leak; The Block and Cointelegraph note that Ledger did not confirm this and that a connection is unclear. heise did not receive a reply from Ledger.

What Ledger advises:

• Ledger will never call, send a direct message or ask for the 24-word recovery phrase; anyone who does is a scammer.