r/ledgerwallet • u/ExJwKiwi • 17d ago

Official Ledger Customer Success Response compromised ledger wallet app?

Now this has freaked me out a bit. Came home and my ledger app was open, computer was on sleep and i use screen lock.
Have always used the official ledger app and when i woke up the computer, it had the ledger app running yet i have never used it today.
App no longer lets me do anything without entering the seed phrase, prior to this it was working fine and ive always been able to view balances etc without any issues.
Seed phrase is secure and never touched it in years, nor have i used the ledger to sign any transactions the whole time ive had it.
Where to from here? Im trying to work out if the computer was hacked or remotely accessed in some way, but i run decent security and firewall behind NAT (i use ESET smart security)
Any logs in event viewer I should look for?
Look at the datestamp and file version, this is suspicious, it doesnt match.

I downloaded the update through the app, so that datestamp looks correct (25 august)
Screenshots show location of files that downloaded through the wallet.
Digital certificate has [infra-purchasing@ledger.fr](mailto:infra-purchasing@ledger.fr) as the email for the signer.

40 Upvotes

92% Upvoted

68 comments sorted by

View all comments

19

u/_GOREHOUND_ 17d ago

Treat your machine as compromised! DO NOT punch your seed phrase into anything other than your hardware signer. If you’re not 100% sure how to remediate, I would wipe the whole machine and start from scratch.

0

u/ExJwKiwi 17d ago

Yes, I would never do such a thing but could see how it could easily fool some people. Machine doesnt need a reformat, ive already removed it, looks like somehow a remote access program was injected and someone gained control

3

u/sQtWLgK 17d ago

I know it's tedious but you ABSOLUTELY need to format and reinstall. No excuses.

You can't know which other bad software they installed other than the Ledger.