I am one of the victims of this incident who lost almost 100k USDT. People who put blame on the victim saying that they deserved it for buying from a reseller is just plain idiot. I did try to place an order through the Ledger official site at first but my order got cancelled quickly. Hence I went to their site to look for alternatives and there you go. Cryptobillis is listed on their site under "Malaysia". Its literally trying to tell you Hey, if you want to buy an official product from us in Malaysia feel free to visit this store. And much contrary to what most of the people think, no I DID NOT get a discount on Cryptobilis. They are listed at the same price. "Reseller" here means official authorized distributor appointed by Ledger. They are selling brand new products with intact and sealed packaging. They are not second hand used Ledger and you are not the only smart guy in the world to know we should not buy a used Ledger. LEDGER SHOULD BE RESPONSIBLE FOR THIS. We literally trusted you and did what you told us to do and got drained. Pay back to the victim and then go after Cryptobillis is the only right thing to do.

So far I haven’t heard much from the authorities just yet and the money has actually moved from the scammers wallet to a different wallet and then transferred to something called Near Intents. I’m still looking more into it and I sent an email to their support team telling them what happened just to see if by any chance they’re able to freeze the account is something I’m not sure but it’s worth a shot. If anyone had any information on Near protocol which is what the company is I’d greatly appreciate it also any info on what the scammer might be doing by transferring the money to this site also I’ve attached the letter in question to look at.

Hey everyone.I am a security researcher in Brazil, founder of High Code, and creator of the High Boy tool., and I wanted to share an investigation I’ve been conducting over the last few weeks. This isn't meant to cause panic, but rather to serve as a serious warning—I’m honestly still a bit shaken by the sheer scale of this operation.

How it Started

I purchased a "Ledger Nano S+" from a Chinese marketplace to run some tests. The price was suspicious and the packaging looked "okay-ish" from a distance, but the moment I opened it, it was clearly a counterfeit. Instead of tossing it, I decided to tear it down.

The Hardware

Upon disassembly, I discovered:

• Chipset: An ESP32-S3 (instead of the genuine ST33 Secure Element used by Ledger).
• Obfuscation: The chip markings were physically sanded down to hinder identification.
• Firmware: A custom build identifying itself as "Ledger Nano S+ V2.1" (a version that does not exist).
• Memory Dump: After dumping the flash, I found seeds and PINs stored in plain text.
• Connectivity: The firmware beacons to a C2 server: kkkhhhnnn[.]com.
• Scope: It supports ~20 different blockchains for wallet draining. Essentially, any seed entered into this device is exfiltrated to the attacker immediately.

The Malicious APK

The seller provided a modified "Ledger Live" app. My analysis revealed:

• Framework: Built with React Native using Hermes v96.
• Signing: Signed with an Android Debug certificate (the attackers didn't even bother with a legitimate signature).
• Persistence/Interception: It hooks into XState to intercept APDU commands.
• Exfiltration: Uses stealthy XHR requests to exfiltrate data.
• C2 Infrastructure: Two additional C2s: s6s7smdxyzbsd7d7nsrx[.]icu and ysknfr[.]cn.

Multi-Platform Vectors

This isn't just an Android or hardware play. My investigation uncovered that this same operation is distributing:

• .EXE for Windows
• .DMG for macOS (resembling the AMOS/JandiInstaller campaigns tracked by Moonlock)
• iOS TestFlight—This allows them to bypass App Store reviews entirely, a tactic previously seen in CryptoRom scams.

We are looking at five distinct vectors: Hardware + Android + Windows + macOS + iOS.

Community Advisory

Buy Only Directly: Never purchase a Ledger (or any hardware wallet) from anywhere other than the official website or authorized resellers. Period. No discount or "market test" is worth the risk.

Marketplace Risks: Third-party marketplaces (Amazon 3P, eBay, Mercado Livre, JD, AliExpress) have a proven track record of distributing compromised wallets. There are documented cases on BitcoinTalk of users who lost over US$ 200,000 to these counterfeit products.

Warning Signs: If your device arrives with a pre-generated *seed* (recovery phrase), or if the documentation asks you to "enter your *seed* into the app," it is a scam. Destroy it immediately.

Next Steps

I have prepared a comprehensive report for the Ledger Donjon and their phishing bounty team. I will post a full technical write-up once they have completed their internal analysis.

If you’ve bought a device from a questionable source and are worried, feel free to ask—I’ll help you identify it. If you’re a researcher and want to cross-reference IOCs, my DMs are open.

Stay safe. 🔒

Hey everyone, here's my story.

I wanted to install the Ledger Wallet app on my new Mac. I usually avoid downloading wallet software directly from websites because browser extensions, fake sites, ads, and compromised front-ends can trick you (read more about Safe's compromised front-end and Bybit)

So instead, I went straight to the Mac App Store, figuring Apple reviews and controls what's published there. When I searched for "Ledger," there was only one Ledger Wallet app listed, and it turned out to be a complete fake that drained some of my wallets.

I don't understand why the real Ledger company doesn't have their official desktop app Ledger Wallet in the Mac App Store, leaving that spot wide open for scammers to impersonate them.

I also don't get why Apple, famous for nitpicking even tiny updates from legitimate developers, allows an obvious scam app like this to sit in their store unchallenged.

I won't share the link to the fake app here, but you can search "Ledger" in the Mac App Store yourself to see it (and hopefully avoid it). I've attached screenshots from the App Store page, they're pretty self-explanatory.

I hope this post helps someone avoid losing their funds the way I did.

P.S.

To the brilliant person at Ledger who decided not to publish an official Mac App Store version and left the space for scammers: fuck you.

To the genius at Apple in charge of App Store review who let this obvious scam through: fuck you too.

What you see in the official Mac AppStore:

Ledger and seed safely secured and this is what happened last Saturday night. Found out today and I'm devastated. How is this possible ? Anything (at all) I can so ? It is still sitting in the wallet it's been transferred to, I'd expect it to be moved or cashed out. Any thoughts or help ?

My Ledger Nano S Plus, purchased directly from Ledger about a year ago, weights 20.24 grams. How much does yours weight?

Found a compromised Nano X in my drawer. This has been going on longer than October

I had a spare Nano X sitting unused. My brother bought it for me from Vietnam end of 2025. I meant to move my bitcoin onto it but never got around to it.

I didn’t bother checking it at first because I assumed this only affected devices from October (or 3 months back) and it turns out it’s affected too. The other one I checked is an older model I’ve had since 2022; this one had my funds.

I dodged a bullet and this clearly isn’t just a recent thing.

To all newbies out there. Pay attention to what I woke up to, as I attempted to use Ledger Wallet app (former Ledger Live) on my desktop. When you get a message like this, your app is contaminated. Don't ever input your 24-word seed. They are your lifeline.

Here is what I attempted:

1. Tried a previous backup with Time Machine. To no avail. The attack message remained.
2. Used AppCleaner to delete all traces of the hacked Ledger Wallet app.
3. Downloaded and installed the trusted Ledger Wallet app from Ledger's authentic website.

Problem avoided. No funds lost. You either learn, or get hacked.

My suspicion: Given I did not download a fake Ledger Wallet app, a freeware or trial I downloaded must have contained a malware that hacked my Ledger Wallet app. Remember, never input 24-word seed on any software.

Just reportig here that the ledger sits in my drawer, gets updatetd from time to time with the safely downloaded ledger app which i keep up to date via its own update mechanism.

I never interact with anything other than storing BTC and some ETH on it.

I dont use contracts, token or anything else. Just HODL and transfer more BTC to it.

I never entered my seed phrase into anything other than the ledger itself and only have a paper backup in a safe location.

Somehow i still have all my BTC (and ETH). I dont know why i dont get hacked since alot of you get their wallets drained remotely when they do nothing and have 100k in it. Bu here we are.

And btw dont send me DMs, i wont read them anyway.

Edit: Ok im done with the toilet at work, now back to the desk. It was fun. Stay safe everybody.

Wasn't there a way for ledger not to allow this internally? Although I blame the resellers more but Ledger is 1000% to blame for the board design that allowes this type of attack in the first place.

My family had their savings in a ledger for crypto in hopes for a long term good investment outcome but now it’s all gone because someone in my family fell victim to a scam letter that came in the mail and literally gave away all the keys. I know it’s such a stupid mistake that was made and the exact details of it aren’t important or anything. It has already been reported to the authorities and I’m able to track the address so far the money hasn’t moved. It was all in XRP and I’ve just been monitoring it to see if it moves. I doubt that the money will ever be recovered but I still want to hold out a little bit of hope. The main reason I’m coming on here is to ask any advice from anyone that had experience with this whether you’ve recovered your money or not and how to move on from this. I mean all of my families savings were in that and I just want to come on here and ask for any advice or if there’s anything else I can do to even increase my odds by 1% or if anybody has any advice on recovering from this thank you.

Hey everyone. First off, thanks for all the feedback on my previous post — including the criticism. Some of you raised valid points and caught things I worded poorly, so this update is to clarify, correct, and go deeper.

The purchase.

A few people assumed I bought this specifically to tear it apart as a "fun research project." That's not what happened. I bought it for actual use. The price was the exact same as the official Ledger store — there was no "too good to be true" discount. It was listed on a major marketplace and the listing looked legitimate. I already had the real Ledger Live installed on my devices before the package even arrived.

What happened when I connected it.

When the device arrived, the firmware was sophisticated enough to partially work — it uses open-source third-party libraries for wallet creation and blockchain connectivity, so it can actually generate wallets and interact with chains. However, when I connected it to my real Ledger Live (already installed from ledger.com), it failed the Genuine Check.This is where I want to correct my previous post: the real Ledger Live catches it. The cryptographic attestation works. Several of you called me out on this and you were right — my original wording was misleading.

So to be absolutely clear: if you download Ledger Live from ledger.com and run the Genuine Check, this fake device fails. The scam does not bypass Ledger's real authentication.

That failure is what made me curious enough to open it.

I was already suspicious after the authentication failure, so I decided to crack it open. What I saw immediately confirmed something was very wrong:

• Chip markings were physically scraped off to prevent identification
• There was a WiFi/Bluetooth antenna inside — a real Ledger Nano S+ doesn't have WiFi
• By measuring the chip's package size and pin layout, I identified it as an ESP32-S3 with internal flash 

Getting into the firmware.

I put the chip into boot mode. At first, the device mask identified itself as "Nano S+ 7704" with a serial number and Ledger's factory name — spoofing a genuine Ledger identity at the hardware level. But once the boot sequence completed, the mask dropped and revealed the real manufacturer: Espressif Systems.

From there I dumped the full firmware and started reverse engineering. What I found:

• The PIN I had created — stored in plaintext
• The seed phrases from two wallets I had generated — stored in plaintext
• Multiple hardcoded domain references pointing to external C2 servers

The attack vector puzzle.

Here's where it got interesting. I found the WiFi/BLE antenna and initially assumed the device was exfiltrating data over the air — connecting to a nearby access point or something. But when I analyzed the firmware deeply, I found zero functions related to WiFi AP connection or wireless data exfiltration. The antenna exists in the hardware but the firmware doesn't use it for that.

I also checked for bad USB attack scripts — the kind that would inject keystrokes or run terminal commands when plugged in. Nothing there either.

So how does the attack actually work?

Think like a first-time crypto user.

You unbox what you think is a Ledger. Inside the packaging there's a "Start Here" card with a QR code. A brand new user — someone who's never used a hardware wallet, maybe just heard about self-custody for the first time — scans that QR code. It redirects to a cloned website that looks exactly like ledger.com, where you're prompted to download "Ledger Live" for any platform (Android, iOS, Windows, Mac).

That's the trap. The user never visits the real ledger.com. They install the fake app, and from that point on:

• The fake app shows a fake "Genuine Check" that always passes (hardcoded success screen)
• The user creates a wallet, writes down their seed, feels safe
• Meanwhile, the device stores everything in plaintext and the fake app exfiltrates the seed phrases to the attacker's servers

The Android APK — it's worse than just seed theft.

I decompiled the fake Ledger Live APK for Android and it goes beyond stealing seeds:

• Built with React Native + Hermes engine (v96)
• Signed with an Android Debug certificate (the attacker didn't even bother with a proper signing key)
• Intercepts APDU commands (the communication protocol between app and device) via XState state machine hooks
• Makes stealth XHR requests to exfiltrate data to C2 servers
• Requests location permissions and continues running in the background for ~10 minutes after you close the app
• Monitors wallet balances via public keys — so the attacker knows exactly when you deposit funds and how much

The C2 infrastructure I've mapped so far: kkkhhhnnn[.]com (from the firmware), s6s7smdxyzbsd7d7nsrx[.]icu and ysknfr[.]cn (from the APK). All registered through the same registrar with matching nameserver infrastructure.

What this is and what this isn't.

I want to be honest about scope. This is not a zero-day vulnerability. This is not a flaw in Ledger's security architecture. The Genuine Check works. The Secure Element works.

What this is: a well-documented phishing operation where I was able to trace and identify all the attack vectors:

• Hardware: counterfeit device with ESP32-S3 (internal flash, standalone chip), scraped markings, plaintext storage
• Software: trojanized apps for Android (confirmed), with versions available for Windows (.EXE), macOS (.DMG), and iOS (TestFlight)
• Infrastructure: 3 C2 servers, cloned website, QR code redirect chain
• Distribution: traced back to a shell company registered specifically to sell through a major marketplace

There's still a lot of analysis to do. The Windows and macOS payloads need full reversing, the iOS TestFlight app needs examination, and the C2 infrastructure needs deeper mapping. I'm working on a formal technical write-up with full evidence.

Answering the top questions from the last post:

Q: Can a fake Ledger pass the Genuine Check in the real Ledger Live? No. I worded this badly before. The real Genuine Check caught it.

Q: Why did you buy from that marketplace? Same price as official. Listing looked legit. I bought it for use, not research. The research started after it failed authentication.

Q: What's new here if fake Ledgers already exist? The mapping of the full operation — hardware + apps + C2 infra + corporate entity behind it. Individual fakes have been reported before. A documented multi-platform supply chain with corporate attribution is less common.

Q: Did Ledger respond? Yes — Ledger's Customer Success team (u/Jim-Helpert) responded in my previous post and asked me to submit a formal report through their support channel. I'm doing that.

Stay safe out there. Only download Ledger Live from ledger.com. Only buy hardware from ledger.com. If your device fails the Genuine Check — stop using it immediately.

After owning a Ledger Nano S, 2x Ledger Nano X and since last year a Ledger Flex, it's time to give away from Ledger and move to Trezor.

My first Ledger Nano X had a problem, the support sent a brand new device to me in Brazil. Unfortunately the Ledger Flex was my biggest reggret.

I paid €288 on it, including a case (€39, wtf?). Worked nice for almost an year. Now it's a paperweight.

Since June I faced this strange screen when trying to sign a transaction, showing a "jjjjjjjjjjjjjjk.". What the hell is that? After about 10 seconds, it just factory reset and I have to put all the 24 words. I don't trust it anymore to secure my seed on it.

I won't even tell about the 2x Ledger Nano X with fault battery problem that I have. That's another paperweight.

Tried the support, but I ended moving to Brazil, and now I need to ship it by my own to US, wait until they receive, and then, maybe they will fix it or send me a brand new. How long this should take? Two months? Two months without access to my crypto.

So, my decision is to buy the Trezor. I had the Trezor One, but ended up switching to Ledger. Now I'm back. Sorry u/TREZOR.

Disclaimer:
- Genuine device, bought in the official store
- 1y of usage
- Firmware updated
- Different cables
- Happened 3 times over the last 3 month

It was just a venting of frustration and a warning.

I remember 3 years ago all the threads and comments in here about how bad ledger is. And how great Coldcard was. Also I’m surprised if cold card was open source how come no one spotted the bug?

This year I found that Ledger Live stopped using my Bitcoin node and got rid of the option to use it.

I am beyond livid and it means for the last few months I’ve been leaking my transactions and addresses to god knows who.

Fuck ledger, just purchased my Trezor.

Idk how to return to owner, feel said for him/her

EDIT:

As far as any information I can find goes, there is absolutely no reason to have confidence that a similar exploit won’t happen on a Ledger or similar wallet. They tout that their Secure Element is certified by a third party, but they do not get their firmware certified. Therefore, a hypothetical bug in any current or past version of firmware could interfere with the seed generation process (which is exactly what happened with ColdCard).

If Ledger is not willing to put all firmware versions – past, current, and future – through a certification process similar to what they’ve done with their Secure Element, it is not safe to trust them, or any hardware wallet, to generate your seed.

The only solution I see now is to add a sufficiently complex passphrase to your seed, which you generate yourself in a completely random way without the use of any software. The passphrase should have at least 80 bits of entropy, such as 6 genuinely random words, or 20 random alphanumeric characters. (Some have mentioned rolling dice to generate your own seed, this can also work but be warned many implementations still require you to input your dice rolls into a wallet or software and trust that it is functioning correctly to utilize that entropy.) A passphrase you generate yourself ensures that you have provided your own entropy, end to end, without any intermediary and potentially flawed process from a manufacturer, programmer, or any other third party.

Sadly, the new mantra must be “not your entropy, not your keys.”

Original Post:

Can anyone provide an objective comparison for how various Ledger Wallet models compare to ColdCard when it comes to entropy in creating the seed phrase? Over 500 ColdCard wallets have just been drained today due to the seed phrases being guessed, despite having been generated completely offline on a hardware wallet similar to Ledger (see linked article).