Is the "Ledger firmware update" email or website a scam?
Published · Updated
VERDICT: SCAM A website, email, text or message that asks you to update your Ledger firmware through a link is a phishing attempt. On Oct 16, 2026, SlowMist warned that a fake "Ledger firmware update" campaign was exploiting the recent Ledger supply-chain news. The fake pages copy the "Genuine check" screen, add a device picker and an "Update Now" button, and their goal is your recovery phrase. (SlowMist)
Ledger says it does not send emails asking you to update device firmware. (Ledger)
Why this scam is everywhere right now
Scammers are riding a real story, which is why the fake pages feel believable:
- Oct 9, 2026: Ledger opened an investigation into users losing funds from devices bought through CryptoBilis, a Malaysia-based reseller, and told CryptoBilis to stop selling and shipping Ledger devices. (BleepingComputer)
- Oct 10: Ledger confirmed that one affected user's device contained "an unauthorized hardware implant." (BleepingComputer)
- Oct 13: Ledger's security lab, Donjon, said the implant reads the 24-word recovery phrase off the screen during setup and sends it out over LTE using an eSIM. The implant does not modify the Secure Element or the Ledger OS, so Ledger's integrity self-checks cannot detect it. (CoinDesk; BleepingComputer)
- Oct 15: Ledger called it "a localized distribution attack," not a systemic supply-chain attack. It said there was no flaw in its chip, OS or servers. It asked authorized resellers in Southeast Asia and Hong Kong to suspend sales. (Ledger)
- Oct 16: SlowMist flagged the fake firmware-update campaign. (SlowMist)
How much was stolen: on-chain analytics firm Bitquery estimated about $93.2 million from 315 wallets across six chains. Ledger has not confirmed that figure. (The Crypto Times) [Uncertain: the loss figure is a third-party estimate.]
How to tell a fake from the real thing
| Fake | Real |
|---|---|
| An email, text, DM, phone call or letter tells you to update firmware or run a Genuine Check | Updates run inside the official Ledger Wallet app (formerly Ledger Live), and you confirm each step on the device itself (The Crypto Times, citing Ledger) |
| A web page asks you to type or select your 24 words | "You should never enter your 24 words anywhere other than directly into your device" (Ledger) |
| The sender's address is a lookalike domain | Ledger lists its real email domains as @ledger.fr, @ledger.com, @ledgerwallet.com and @ledger.zendesk.com (Ledger) |
| A "Ledger agent" calls, texts or DMs you | Ledger says it will never contact you by text message or phone call, and never sends direct messages on social media (Ledger) |
| A download link sent to you | Ledger says the only place to download its app is ledger.com/ledger-live (Ledger) |
A passing Genuine Check does not prove a device is clean. Ledger warns that the check cannot detect added implants when the device's original Secure Element is intact. (BleepingComputer)
If you already typed your recovery phrase into a website
- Assume the wallet is compromised. Anyone with the phrase can restore your wallets on another device and move the funds. (The Crypto Times)
- Set up a new wallet with a new recovery phrase on a device from a trusted source. Move your funds there right away, most valuable first. Do not re-import the old phrase. Ledger gives the same advice to CryptoBilis buyers: move assets "to a new Ledger signer (with a new seed)." (BleepingComputer, quoting Ledger)
- Report the phishing. Ledger asks users to report fake communications to its dedicated phishing address, [email protected]. (Ledger) Also file at ic3.gov if you lost money.
- Ignore "recovery" offers. The FBI warns that services claiming they can recover lost crypto are often scams themselves. (FBI)
If you bought a Ledger from a reseller
- If you bought from CryptoBilis: Ledger says do not set up the device if you haven't yet. If you already did, move assets to a new signer with a new seed. (BleepingComputer)
- Other sellers: Some users have reported modified devices from other sellers in Asia and Europe, including an airport retailer in Singapore and MediaMarkt. MediaMarkt pulled the product. Ledger says all confirmed losses involve CryptoBilis devices. (BleepingComputer)
- Ledger's own response: it reports spot-buying and opening devices from stores, including in Germany, and says "every unit examined was clean." (Ledger)
- Other makers are tightening too. Trezor says it found no evidence its devices were compromised, but it is ending some reseller partnerships on Jan 1, 2027. (BleepingComputer)
For the general rules on buying and setting up any hardware wallet, see our wallet safety guide.
No affiliate links on this page, by policy. Ledger runs an affiliate program that we may join for product reviews. See disclosures.
Sources
- SlowMist TI Alert on X, Oct 16, 2026 (06:56 UTC). x.com/SlowMist_Team/status/2110988183039332417 (read 2026-10-19)
- Ledger, "Ongoing phishing campaigns." ledger.com/phishing-campaigns-status (read 2026-10-19)
- Ledger, "Ledger's Response to the Hardware Implant Attack," Oct 15, 2026. ledger.com (text read via search extract, 2026-10-19)
- BleepingComputer, "Ledger confirms spy chip implant behind wallet crypto thefts," Oct 12, 2026. bleepingcomputer.com (read 2026-10-19)
- BleepingComputer, "Ledger asks sellers across Asia to halt sales after supply-chain attack," Oct 14, 2026. bleepingcomputer.com (read 2026-10-19)
- CoinDesk, "Ledger finds covert cellular implant stole hardware wallet recovery phrases from screens," Oct 13, 2026. coindesk.com (text via search extract)
- The Crypto Times, "Fake Ledger Firmware Update Scam Exploits CryptoBilis Hack, SlowMist Warns," Oct 16, 2026. cryptotimes.io (read 2026-10-19)
- FBI, "Cryptocurrency Investment Fraud." fbi.gov
Changelog
- 2026-10-24: Corrected Ledger's phishing-report address to [email protected], as shown on Ledger's phishing-campaigns page (read 2026-10-24).
- 2026-10-19: First published. Before publishing, check Ledger's blog for an official loss figure.