Fake Ledger Devices & Ledger Scams: How to Spot Them

An email arrives with your real name and your real address, warning that your Ledger needs a firmware update, and linking to a page that asks for your 24-word recovery phrase. That email is a scam, and so is almost everything else that claims to be Ledger and asks for those same 24 words: fake websites, fake devices, fake support, and fake recovery agents. They are built to look legitimate, so experience alone is no protection. Knowing how each one works, and what to do in the first minutes if you already gave up the phrase, is what actually protects your funds.

Why scammers target Ledger users

A hardware wallet is only as strong as the 24-word recovery phrase behind it. The device itself is hardened, but the phrase is the single point of failure: anyone who holds those 24 words can regenerate every private key and drain every account without ever touching your Ledger. Scammers know this, and every Ledger scam has the same objective: obtain the phrase, or trick you into approving a transaction you don't understand.

If an email, website, app, or person asks for your recovery phrase, a "verification" of your words, or a photo of your seed card, the conversation is a scam regardless of how official it looks.

Phishing emails and text messages

In July 2020, Ledger's e-commerce and marketing database was breached. According to Ledger's own update, about one million email addresses were stolen, and for roughly 272,000 customers the leaked records also held names, postal addresses and phone numbers. The breach did not expose private keys, seed phrases, or wallet data: the leaked data was contact information only, as our article on what the Ledger breach did and didn't expose explains.

What followed was a sustained phishing campaign that used that real customer data to make fake contact look credible: emails with your real name, referencing your real address, claiming your device needed a firmware update or your accounts were at risk. Every one of those emails pointed to a website asking for your 24-word recovery phrase. A January 2026 leak of order data at Ledger's e-commerce partner Global-e has fed new phishing emails since.

Ledger will never ask for your recovery phrase by email, text message, or any online form. The phrase is entered on the physical device only, during initial setup or restoration. It is never typed into a website, an app, or a chat window — not for verification, not for "security", not for support. If any communication asks for it, it is a scam. Delete the message, do not click the link, and do not reply.

Ledger also never contacts customers by text message or phone call, so treat any "Ledger" SMS, WhatsApp or Telegram message, call or letter as phishing. Its list of ongoing phishing campaigns shows current examples and the sender domains Ledger genuinely uses: ledger.com, ledger.fr, ledgerwallet.com and ledger.zendesk.com.

Fake Ledger websites and fake Ledger Live apps

Fraudulent domains mimicking Ledger appear in search results, in paid advertising slots, and in phishing emails. Common patterns include domains that add hyphens or extra words, deliberate misspellings such as "legder" or "ledqer", "support" or "download" variants of the Ledger name, and addresses that begin with "ledger.com" but continue into a different domain. These sites can look identical to the real thing and offer to help you sync, verify, or restore your wallet. All of them need your seed phrase.

Ledger's website is ledger.com, and its official support site is support.ledger.com. Ledger's app, now called Ledger Wallet (formerly Ledger Live), should come from Ledger's download page only; on a phone, use that page's links to the App Store or Google Play rather than searching the store. Never install it from a link in an email, a search advertisement, a YouTube description, or a pop-up. Fake Ledger apps have even reached official stores: in April 2026, Kaspersky documented phishing copies in Apple's App Store that asked for the recovery phrase. Malicious browser extensions impersonating Ledger have appeared in extension stores too. Check the developer name and the download count before installing any extension. If it asks for wallet permissions, it isn't Ledger's, whatever the listing claims.

Fake Ledger devices

Counterfeit Ledger hardware is documented, and Ledger describes the variants in its guide to buying a device safely. Externally these devices can look identical to genuine Ledgers; internally the firmware is modified. The most dangerous variant arrives pre-loaded with a seed phrase already known to the attacker: any funds sent to addresses derived from that phrase are immediately accessible to them, even before the buyer has set up the device.

Some fake devices instruct users to enter a phrase printed on a card inside the box instead of generating a new one. A genuine Ledger always generates a fresh, random 24-word phrase during first-time setup and never arrives with a recovery phrase or PIN already set. Another variant arrives by post as an unsolicited "replacement" with a letter urging you to migrate: Ledger never sends replacements unsolicited, and in a 2021 case it describes, such a device hid malware. Don't plug in a device you didn't order.

Buy only from ledger.com or from a seller on Ledger's list of authorized resellers, which includes official Ledger storefronts on Amazon; on a marketplace, check that the "Sold by" name matches that list. When a new device arrives, run the Genuine Check in Ledger Wallet before adding funds: it uses a cryptographic challenge to verify that the Secure Element chip is authentic. Use Ledger Wallet downloaded from Ledger for this, because counterfeit devices can come with modified apps that report "genuine".

Packaging proves little either way: counterfeits are often built to pass visual inspection, and Ledger relies on the Genuine Check rather than an anti-tamper seal, so an absent seal is not evidence of a counterfeit. A box that has clearly been opened is different: Ledger says not to use that device and to contact Ledger Support.

Fake customer support and "recovery" scammers

Scammers actively monitor Reddit, Telegram, Discord, and Twitter/X for users posting about wallet problems, then offer help by direct message from fake support accounts. The assistance always leads the same way: a request for your seed phrase, or a link to a fraudulent website. Ledger's official support channel is support.ledger.com. Ledger says it never sends direct messages on social media and never phones customers; some scammers open a support ticket in your name first, so that a genuine confirmation email makes their call look real. Ledger staff never ask for your seed phrase under any circumstances.

A second, crueler wave targets people who have already been scammed. After funds are lost to a phishing site or a fake wallet, "recovery agents" contact the victim claiming they can locate and retrieve the stolen coins, for an upfront fee or a percentage. These are recovery scams. Legitimate companies do not contact you out of the blue, do not charge upfront fees to "unfreeze" or "locate" stolen funds, and never ask for your full seed phrase or private keys. If someone promises to recover stolen crypto in exchange for an advance payment, that promise is the scam. The full pattern is explained in our guide to finding a legitimate crypto recovery company.

If you've already given your seed phrase to a scammer

Act immediately. The wallet is compromised the moment someone else has those 24 words: they can regenerate every private key and drain every account, and they can do so within minutes.

1. Move any remaining funds to a completely new wallet generated on a clean device with a fresh seed phrase. Do this first, before anything else.
2. Transfer every asset from every account derived from the compromised phrase, including accounts in other wallets that used the same phrase.
3. Only after the funds are moved, reset the compromised device and never reuse the old phrase for anything.

Do not try to "lock" the wallet by changing the PIN or updating firmware first: none of those steps protect against someone who already has the phrase. And do not use any recovery service that asks you to send the compromised phrase, a photo of it, or password guesses. A phrase that has touched a scammer's hands is burned, not recoverable. For storing the new phrase safely, see our guide to Ledger backup options. If you're unsure whether something was a scam, the crypto scam warning signs guide helps you check before you act.

What Crypto Recovers does

We work on legitimate access recovery: people who still own their funds but can't reach them because of missing words from a seed phrase (we work with up to four missing words), an invalid seed phrase, or a broken backup. A completely lost seed phrase, with nothing else to work from, cannot be recovered. We do not work on theft recovery or fraud cases — the same rule that protects our clients from recovery scams. If your situation involves lost access rather than theft, request a confidential assessment to recover your Ledger wallet.

A legitimate recovery service never needs your funds, and we never hold them: if access is restored, you move the coins yourself to a new wallet you control.

FAQ: Fake Ledger scams

How can I tell if my Ledger is genuine?

Use Genuine Check in the official Ledger app; it verifies the device cryptographically. Packaging seals and holographic stickers are not proof of authenticity. When creating a new wallet, the device generates its phrase itself. Never use a phrase or PIN supplied in the box.

Does Ledger ever ask for my recovery phrase by email or support chat?

Never. The recovery phrase is only ever entered on the physical device. Any email, chat, or website asking for it is a scam, even if it uses your real name and address.

I received a message saying my Ledger account is at risk. What should I do?

Do not click any link. Genuine Ledger security notices point to ledger.com or support.ledger.com and never ask you to enter your phrase or download a file. Open ledger.com directly and check your device in Ledger Wallet (formerly Ledger Live) instead.

Can a fake Ledger device steal my funds?

Yes. Counterfeit devices can be pre-loaded with a seed phrase known to the attacker, so any funds sent to the derived addresses can be drained immediately. Buy only from ledger.com or official authorized resellers and run the Genuine Check before adding funds.

I already sent my seed phrase to a scammer. What now?

Move every remaining balance to a new wallet with a fresh seed phrase immediately, generated on a clean device. Do not add more funds, do not change the PIN first, and never reuse the compromised phrase.