Scammers send letters to Ledger users trying to steal their mnemonic phrase.

Source: Cointelegraph Original: "Scammers Send Letters to Ledger Users in Attempt to Steal Mnemonic Phrases"

Scammers send physical letters to users of Ledger hardware wallets, asking them to verify their private key phrases in order to access their wallets and drain their funds.

On April 29, in a post on platform X, tech commentator Jacob Canfield shared a scam letter sent to his home, which appeared to be from Ledger, claiming that he needed to perform a "critical security update" on his device immediately.

The letter uses the Ledger logo, company address, and reference number to pretend to be legitimate. The letter asks users to scan a QR code and enter their wallet's private key recovery phrase under the name of a verification device.

The letter threatens: "Failure to complete this mandatory verification process may result in restricted access to your wallet and funds."

A mnemonic phrase or recovery phrase is a string of up to 24 words used to unlock access to a cryptocurrency wallet. Scammers who possess this phrase can access and control the associated wallet, allowing them to transfer its assets elsewhere.

Earlier this month, an X account of a cryptocurrency hardware wallet reseller reported that it had received multiple reports from Ledger users about receiving similar letters.

In response to Canfield's post, Ledger stated that the letter is a scam and reminded device users to remain vigilant against phishing attempts.

Ledger added: "Ledger will never ask you for your 24-word recovery phrase via phone, direct message, or otherwise. If someone does, it's a scam."

"Please do not interact with accounts claiming to be Ledger employees or anyone offering fund recovery assistance."

Canfield suggests that scammers may send letters to Ledger customers whose data was leaked nearly five years ago.

In July 2020, hackers breached Ledger's database and leaked the personal information of over 270,000 customers online, including names, phone numbers, and home addresses.

Bleeping Computer reported at the time that the following year, multiple Ledger users claimed to have received tampered fake Ledger devices that would install malware when used.

Related news: Loopscale recovers $2.8 million through bounty negotiations after the weekend DeFi attack incident.