Key takeaways

  • Blockchain security company SlowMist issued a threat intelligence alert warning of a fake Ledger firmware update campaign exploiting the October 9 CryptoBilis incident.
  • The campaign uses an email posing as The Ledger Team, lists Nano S Plus, Nano X, Flex, Stax and Nano Gen5, and ends with a fake Genuine check prompt for the recovery phrase.
  • Ledger continues to state that it will not call, DM or request a 24-word recovery phrase; firmware updates belong in the official Ledger Live app on the user's own device, not in email links.
  • Do not update through website links, do not enter the recovery phrase anywhere, and delete urgent messages.

What happened

SlowMist's alert says the Ledger supply chain incident has cooled only slightly, but scammers are already cashing in on the confusion that followed. SlowMist says the campaign looks very real. It describes a fake Ledger firmware update campaign tailored to the moment. Screenshots show a polished email posing as The Ledger Team and claiming a firmware update is available.

The email frames the update as essential for protection against rising spyware threats and mentions recent incidents in Malaysia, unauthorized third-party applications and potential fund theft. It lists affected devices as Nano S Plus, Nano X, Flex, Stax and Nano Gen5. It promises improved protection against spyware and malicious apps, enhanced safeguards against unauthorized access and important security patches, with a black Update Now button at the bottom.

The button takes the user to a fake Genuine check page that copies Ledger's real verification flow. That page guides victims through device selection and repeats advice recommending purchases through Ledger's reseller network. The wording borrows guidance users have been hearing since the incident. The final step asks for the recovery phrase.

Market context

Phishers did not need to invent a story; the incident already supplied one. The supply chain incident produced a sequence of official instructions: check devices, update compromised signers and follow guidance. In that setting, a security-update email can seem like a logical next step rather than an anomaly.

Ledger's position has not changed. It will never call, DM or ask for a 24-word recovery phrase. Firmware updates are handled through the official Ledger Live app on the user's own device, not through links in emails. SlowMist's advice is direct: never click website links to update, never enter the recovery phrase anywhere, and delete messages that push urgency.

Ledger had warned that scammers might exploit the confusion around the incident. SlowMist's alert shows that warning came true within about a week, as the fake update campaign began using the incident's security language to make phishing messages look more credible.

Why it matters

For users, the practical impact is narrow but severe. A hardware wallet's security model depends on keeping the recovery phrase out of reach of untrusted interfaces. The fake Genuine check page is designed to make that request look routine by copying the sequence of a real verification flow. Once a 24-word recovery phrase is entered into a malicious domain, the wallet should be treated as compromised.

The alert says anyone who entered a phrase into a domain like this should move funds to a new device with a fresh seed immediately. That instruction is blunt because the exposure of the phrase removes the assumption that the device alone is controlling access to funds.

The campaign matters because it is tailored to a specific incident and to specific Ledger products. By naming Nano S Plus, Nano X, Flex, Stax and Nano Gen5, and by citing Malaysia, unauthorized third-party applications and potential fund theft, it makes the message harder to dismiss as noise. The polished email and reseller-network wording increase the sense of legitimacy.

What to watch

The useful signal is whether users continue to receive security-related messages that imitate official guidance. Any email claiming a firmware update and directing the user to a website link should be treated as suspicious. Any request for a 24-word recovery phrase should be treated as an attempt to compromise the wallet, regardless of how professional the page looks.

Users can watch for the core controls described by Ledger: updates through the official Ledger Live app, no phone calls, no DMs and no recovery phrase requests. SlowMist's alert suggests the campaign may evolve as attackers refine the fake Genuine check flow, but the decisive indicator is the final prompt for the recovery phrase.

The broader lesson is that supply chain incidents can create a secondary wave of scams. The first wave affects devices and software; the second wave targets human behavior. Within about a week of the October 9 CryptoBilis incident, the alert shows how quickly that second wave can arrive.