New wave of scam targets Ledger's customers.

[satscraper]

This time it  is fraudulent "Ledger Clear Signing" chuck which urges customers to activate this feature to make  Ledger  wallet continuously working. Involved scammers disseminate this mock via emails which sets deadline  October 31 after which ^{(as they said)} "users that failing to activate this feature will prevent them from using their devices securely." In fact, this email has a link that leads to a fishing site, the aim being to get sensitive info from users ^{("which can give scammers access to their cryptocurrency wallets')}
.

Those, who still use Ledger wallets, be careful to not fall into this scam.

[Charles-Tim]

This can be somehow off-topic but it is still worth posting about. That it is better not to use Ledger devices anymore. Ledger Nano is now an online wallet that gives the option for people to save their seed phrase online with third parties. Not worth using anymore and not worth buying.

[Forsyth Jones]

It's incredible how there are still people who fall for this kind of obvious scam, since the main purpose of every hardware wallet is to keep the mnemonic phrase protected on the device; it should never be entered in any online environment, such as typing on a computer keyboard.

Some people have their first contact with bitcoin and altcoins through these devices and have no basic understanding of how the BIP-39 key derivation scheme works and the consequences, such as total loss of funds after exposing a seed online.

That's why these types of phishing still exist, because unfortunately they are making many victims. I'm afraid that people who have hardware wallets are the easiest to rob.

This can be somehow off-topic but it is still worth posting about. That it is better not to use Ledger devices anymore. Ledger Nano is now an online wallet that gives the option for people to save their seed phrase online with third parties. Not worth using anymore and not worth buying.

As for your post, it’s really sad that Ledger has gone down this path.

[Z-tight]

Thanks for sharing this. Since they launched the ledger recover feature, scammers decided to deceive naive customers with another so-called security feature called 'clear signing', lol, it is crazy and i seriously hope nobody fell for this bullshit. While it is obvious one shouldn't be using ledger anymore, it should be more obvious to anyone who uses a hardware wallet that this is a scam and that they should not click on the link.

[Lucius]

It's incredible how there are still people who fall for this kind of obvious scam, since the main purpose of every hardware wallet is to keep the mnemonic phrase protected on the device; it should never be entered in any online environment, such as typing on a computer keyboard.
~snip~

Why do you think there is a link between the fact that some scammers send such e-mails and the fact that there are still people who do not understand the correct way of using hardware wallets? The database that leaked from Ledger is used constantly, and the fact that someone emphasized this news is nothing specific, because everything always boils down to the same thing.

In addition, every seed generated by some HW is not only important to protect on the device itself in case it falls into the wrong hands or from possible remote attacks, but it should also be properly protected as a backup. The key feature of each HW is that it generates the seed offline in a secure environment, and that every action we perform on the same device must be physically confirmed by pressing a key/button.

[m2017]

This can be somehow off-topic but it is still worth posting about. That it is better not to use Ledger devices anymore. Ledger Nano is now an online wallet that gives the option for people to save their seed phrase online with third parties. Not worth using anymore and not worth buying.

Of course, the best solution in light of the already formed negative public opinion in crypto community about the Ledger company would be to simply not use the ledger devices. But I believe that such incidents should be voiced in order to inform the community for preventive purposes. As a reminder of phishing, which is one of the most common ways to lose cryptocurrency.

At first glance, Ledger is not involved in the "Ledger Clear Signing", because scammers who send phishing letters are as old as the Internet itself. But there is one nuance, which is that these letters are sent to users of ledger devices on purpose, which is reminiscent of the previous leak of the client base of this company.

[bitmover]

It's incredible how there are still people who fall for this kind of obvious scam, since the main purpose of every hardware wallet is to keep the mnemonic phrase protected on the device; it should never be entered in any online environment, such as typing on a computer keyboard.

I think those phising emails affects very few people, if any. Most users will just ignore them. Those doesn`t even appear in my inbox and go straight to spam.

The point is that sending an e-mail is basically free, and as they already have the data of potential victims, they will just keep sending them. If just one person clicks the bait, they make money....

[Floxynice]

This time it  is fraudulent "Ledger Clear Signing" chuck which urges customers to activate this feature to make  Ledger  wallet continuously working. Involved scammers disseminate this mock via emails which sets deadline  October 31 after which ^{(as they said)} "users that failing to activate this feature will prevent them from using their devices securely." In fact, this email has a link that leads to a fishing site, the aim being to get sensitive info from users ^{("which can give scammers access to their cryptocurrency wallets')}
.

Those, who still use Ledger wallets, be careful to not fall into this scam.

Thanks OP for this information

It's incredible how there are still people who fall for this kind of obvious scam, since the main purpose of every hardware wallet is to keep the mnemonic phrase protected on the device; it should never be entered in any online environment, such as typing on a computer keyboard.

Not everyone who have coins stored in wallets really understand how the wallets work. Some people who have very little education about wallets and how scammers operate will easily fall for these scams. Constant efforts in exposing these scam patterns just like OP has just done is what some people need to remain vigilant.

[MeGold666]

I've always said it's safer to be a fish in the ocean than a shark in a tank.

Do yourself a favor and learn how to securely use an air-gapped PC. It takes about an hour for a total beginner to understand, and it's knowledge that will last a lifetime without needing to trust hardware wallet companies.

For small amounts, you can use your phone and Cake Wallet or whatever you prefer.

Phishing attacks are not the fault of hardware wallets, and if you're vulnerable to such threats, you'll get hacked anyway.
Just saying, having an old dedicated laptop is still safer than dealing with these companies.

...The database that leaked from Ledger is used constantly, and the fact that someone emphasized this news is nothing specific, because everything always boils down to the same thing.

The company said they would never store your information, yet they did. They lied, and people still trust them and their closed-source firmware. 😮
I may need to remind you: The whole cryptocurrency revolution is about being trustless, about not having to trust anyone, because trust is always abused.

Any software that is not open-source and not audited should not be trusted, not only in cryptocurrency but in general.

With hardware wallets (or any closed source projects), you're not the owner of the coins; you're the user, and the company behind it is the owner, controlling what happens inside that black box.

[Lucius]

~snip~
The company said they would never store your information, yet they did. They lied, and people still trust them and their closed-source firmware. 😮
I may need to remind you: The whole cryptocurrency revolution is about being trustless, about not having to trust anyone, because trust is always abused.

As far as I remember, they did not promise that they would not keep personal information of their clients, because by law they have the right (and possibly the obligation) to do so. The problem is that they should have kept this information in the best possible way, and not leave it to someone else who is clearly not adequate for such a job.

As for trust, it's pointless to talk about it when a lot of people who invest in cryptocurrencies don't really understand what they're investing in at all. For many, every CEX is equal to a bank, until something bad happens and they realize how wrong they were.

[MeGold666]

As far as I remember, they did not promise that they would not keep personal information of their clients, because by law they have the right (and possibly the obligation) to do so. The problem is that they should have kept this information in the best possible way, and not leave it to someone else who is clearly not adequate for such a job.

They did say they will not store "sensitive client information", whatever they meant by that.
I think home address is very sensitive information, they could argue they had private keys in mind...  

edit: I have checked their page on archive.org before the 2020 data breach and indeed they have stated they will store user information.
Source: https://web.archive.org/web/20190331192622/https://www.ledger.com/pages/privacy-policy

I don't remember where I read it, could be unofficial. Thanks for correction on that matter.

As for trust, it's pointless to talk about it when a lot of people who invest in cryptocurrencies don't really understand what they're investing in at all. For many, every CEX is equal to a bank, until something bad happens and they realize how wrong they were.

True, this people should learn that banks nor any other private company are not to be trusted.

[Lucius]

As for trust, it's pointless to talk about it when a lot of people who invest in cryptocurrencies don't really understand what they're investing in at all. For many, every CEX is equal to a bank, until something bad happens and they realize how wrong they were.

True, this people should learn that banks nor any other private company are not to be trusted.

Good luck to anyone who tries to explain to the average person that they shouldn't trust institutions - because in the end most trust banks and if you ask them why, they will tell you that they feel their money is safe there, because at least in the EU savings deposits up to EUR 100 000 are insured by of the state.

On the other hand, the idea of ​​being your own bank doesn't seem attractive to them at all - that's why for the vast majority Bitcoin has become just a get-rich scheme and that's why companies like Ledger, despite all their scandals, continue to operate as if nothing had even happened.

[Z-tight]

because at least in the EU savings deposits up to EUR 100 000 are insured by of the state.

This is another reason why people are so wrong to think keeping their money in an exchange is similar to keeping it in a bank, between the two it is very obvious that banks are safer. Crypto exchanges are more likely to collapse or go bankrupt and the chances of getting anything back is slim and could take so many years. I even wonder why people would want to use BTC the way they use fiat, they're better off just using fiat only if they are not ready to be their own bank.

[Lucius]

@Z-tight, most people perceive Bitcoin in a similar way to fiat and in conversations with people over the years I have often encountered questions that have no logic, such as "which bank is behind BTC?" or "can BTC be banned and its value drop to zero?"

The concept of decentralization is not something that comes easily to people's heads, because for centuries they have been taught that there are banks, governments and those who make decisions and issue money - the concept on which BTC rests is completely opposite to all that.

Being your own bank and having that responsibility is something that most people don't want - a plastic card and a four-digit PIN is such a simple concept that makes BTC extremely complicated for most.

[satscraper]

Thanks for sharing this. Since they launched the ledger recover feature, scammers decided to deceive naive customers with another so-called security feature called 'clear signing', lol, it is crazy and i seriously hope nobody fell for this bullshit. While it is obvious one shouldn't be using ledger anymore, it should be more obvious to anyone who uses a hardware wallet that this is a scam and that they should not click on the link.

It doesn't relate with  "the ledger recover feature". In fact  to launch this fishing attack  scammers  jumped at the opportunity  opened for them by the existence of  official Ledger’s Clear Signing Initiative ^{(the main goal of which is to clarify to  users some details  of the smart contract they are are going  to sign)}

[sunsilk]

It's incredible how there are still people who fall for this kind of obvious scam, since the main purpose of every hardware wallet is to keep the mnemonic phrase protected on the device; it should never be entered in any online environment, such as typing on a computer keyboard.

Even if it seems a usual scam that we see on a day-to-day basis, there are customers who don't know much about crypto and have just been told to buy a ledger or hardware and take care of it.

And upon reading some scam emails, they'll feel paranoid about it and they're likely to oblige themselves and gonna follow the scammy instructions.

In general, this also probably happening in some other brands that there are email scams that are using their names to "immediate action" being sent to their victims.

[NotATether]

An ideal hardware wallet should function without connecting to the internet at all, including via intermediary applications on an internet-connected computer which do fetch data from the internet.

Understanding this basic detail would save a lot of people from falling for these basic phishing emails. It's not enough to just rely on email filters to hide them for you.

[satscraper]

An ideal hardware wallet should function without connecting to the internet at all, including via intermediary applications on an internet-connected computer which do fetch data from the internet.

This is not to necessarily suggests that any user will be safe. If user is  just dumb dumb dumb he may share ^{(on the fishing site or somewhere else )} his SEED even for the  Internet-blind hardware wallet. However, I'm agreed, air-gapped devices ^{(like mine Passport2)} are better opt for those who wanna mitigates the risks exposed to their stash.

[NotATether]

This is not to necessarily suggests that any user will be safe. If user is  just dumb dumb dumb he may share ^{(on the fishing site or somewhere else )} his SEED even for the  Internet-blind hardware wallet. However, I'm agreed, air-gapped devices ^{(like mine Passport2)} are better opt for those who wanna mitigates the risks exposed to their stash.

I actually think that a good exchange (i.e. not Binance, OKX, Gate etc but something like privacy-invading Coinbase  ) are better for dumb dumb dumb users because even though they are custodial, they will at least give you many warnings not to share your credentials with anyone, and then a competent exchange will implement lots of security measures like 2FA, confirmation before withdraw, maybe even a sort of KYC like facial scan before you can log into a new device. That last one is something I've heard of Revolut doing, and it sounds like it can help really naive people who are vulnerable to scammers.

[Pmalek]

I think those phising emails affects very few people, if any. Most users will just ignore them. Those doesn`t even appear in my inbox and go straight to spam.

Don't be so sure about that. The world will always have enough of gullible people who believe in such fairytales. If that wasn't the case, scammers wouldn't waste time with this type of attack and do something else. It's true that sending such emails isn't hard work but I am sure it still works to some extent.