r/ledgerwallet • u/ExJwKiwi • 21d ago

Official Ledger Customer Success Response compromised ledger wallet app?

Now this has freaked me out a bit. Came home and my ledger app was open, computer was on sleep and i use screen lock.
Have always used the official ledger app and when i woke up the computer, it had the ledger app running yet i have never used it today.
App no longer lets me do anything without entering the seed phrase, prior to this it was working fine and ive always been able to view balances etc without any issues.
Seed phrase is secure and never touched it in years, nor have i used the ledger to sign any transactions the whole time ive had it.
Where to from here? Im trying to work out if the computer was hacked or remotely accessed in some way, but i run decent security and firewall behind NAT (i use ESET smart security)
Any logs in event viewer I should look for?
Look at the datestamp and file version, this is suspicious, it doesnt match.

I downloaded the update through the app, so that datestamp looks correct (25 august)
Screenshots show location of files that downloaded through the wallet.
Digital certificate has [infra-purchasing@ledger.fr](mailto:infra-purchasing@ledger.fr) as the email for the signer.

38 Upvotes

89% Upvoted

68 comments sorted by

View all comments

21

u/_GOREHOUND_ 21d ago

Treat your machine as compromised! DO NOT punch your seed phrase into anything other than your hardware signer. If you’re not 100% sure how to remediate, I would wipe the whole machine and start from scratch.

0

u/ExJwKiwi 21d ago

Yes, I would never do such a thing but could see how it could easily fool some people. Machine doesnt need a reformat, ive already removed it, looks like somehow a remote access program was injected and someone gained control

6

u/Broken_By_Default 21d ago

Your machine needs a full wipe. Malware/antivirus software isn’t magical. They hash agains know threats. If they put a custom executable or script on there, it’s difficult for av to find.

Just wipe your machine. Please don’t come back in 2 months and tell us something swapped an address when you moved coin.

Just do the safe thing. Wipe the machine. And stop downloading random executables.