Ledger and Trezor customers face new phishing campaign

Traders Union
All News
Crypto News
Fake letters hit Ledger and Trezor owners

Highlights

Scammers are sending fake physical letters to Ledger and Trezor users.
Victims are urged to scan QR codes and enter recovery phrases on phishing sites.
Recovery phrases grant full wallet access and should never be shared.

Authorities and cybersecurity researchers warn that owners of Ledger and Trezor devices are receiving letters at their home addresses that impersonate official company communications and attempt to trick them into surrendering their wallet recovery phrases, Сryptopolitan reports.

Physical mail scam targets hardware wallet users

The fraudulent letters, reportedly printed on branded letterhead, claim to come from the security or compliance departments of Ledger and Trezor. Recipients are told they must complete mandatory authentication or transaction checks to avoid losing access to certain wallet features.

In one example reviewed by cybersecurity expert Dmitry Smilyanets, Trezor users were instructed to complete an “authentication check” by February 15 or risk losing access to the Trezor Suite. The letter stated: “Note: While you may have already received the notification on your Trezor device and enabled Authentication Check, completing this process is still required to fully activate the feature and ensure your device is synchronized with the full functionality of Authentication Check.”

Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

The letters direct victims to scan QR codes that lead to phishing websites designed to closely resemble official company domains. These websites then request users’ recovery phrases under the guise of device verification.

How the scam works

Once victims enter their recovery phrases, the data is transmitted to attackers, granting them full access to the associated crypto wallets. A recovery phrase is effectively a human-readable representation of the private key controlling the wallet. Anyone with access to it can move funds without restriction.

Browser security tools have flagged at least one of the phishing domains as malicious. A warning displayed in Chrome cautions users that attackers may attempt to trick them into revealing sensitive information.

It remains unclear how the scammers obtained users’ physical addresses. Both Ledger and Trezor have experienced data breaches in previous years that exposed customer information, raising concerns that leaked data may be fueling the campaign.

Companies urge vigilance

Hardware wallet manufacturers have repeatedly emphasized that they will never request recovery phrases under any circumstances. Such phrases should only ever be entered directly on the hardware device itself, not on a website or shared with anyone.

The shift to physical mail underscores the evolving tactics used by crypto criminals, who continue adapting their methods as digital users grow more security-aware.

Why it matters

The campaign highlights the persistent risks facing crypto investors, even those using hardware wallets considered among the safest storage options. Physical phishing attempts show that attackers are exploiting past data leaks to target victims offline. Users who disclose recovery phrases risk irreversible loss of funds, reinforcing the importance of strict self-custody security practices.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.