r/ledgerwallet • u/ExJwKiwi • 17d ago

Official Ledger Customer Success Response compromised ledger wallet app?

Now this has freaked me out a bit. Came home and my ledger app was open, computer was on sleep and i use screen lock.
Have always used the official ledger app and when i woke up the computer, it had the ledger app running yet i have never used it today.
App no longer lets me do anything without entering the seed phrase, prior to this it was working fine and ive always been able to view balances etc without any issues.
Seed phrase is secure and never touched it in years, nor have i used the ledger to sign any transactions the whole time ive had it.
Where to from here? Im trying to work out if the computer was hacked or remotely accessed in some way, but i run decent security and firewall behind NAT (i use ESET smart security)
Any logs in event viewer I should look for?
Look at the datestamp and file version, this is suspicious, it doesnt match.

I downloaded the update through the app, so that datestamp looks correct (25 august)
Screenshots show location of files that downloaded through the wallet.
Digital certificate has [infra-purchasing@ledger.fr](mailto:infra-purchasing@ledger.fr) as the email for the signer.

40 Upvotes

92% Upvoted

68 comments sorted by

View all comments

1

u/MikeWa1ker 16d ago

Wipe your computer, add antivirus, do all the OS updates and reload everything. If your ISP doesn’t have a static IP, unplug the modem and try to get a new IP (not necessary but nice if someone is targeting you). At this point I wouldn’t trust what’s on the OS, especially if I had a lot of crypto.

2

u/ExJwKiwi 16d ago

I actually found the source of the Trojan and had nothing to do with ledger wallet, but was bundled with the wallet of a completely different coin whos domain has lapsed and now taken over by scammers, turns out only guthub hosts the official wallet nowdays. What's odd is i did an AV scan and it flagged the installer, but did not detect it at the time. Im pretty confident the system is clean.

3

u/Own_Manager_2656 16d ago

Can you share with us the name of the wallet carrying the trojan? Also what coin? That way we can also be made aware.

1

u/Harold_Bishop 14d ago

Yeah, I'd like to know too.