Phishing scammers are capitalizing on the recent $86 million Ledger spyware scandal with a new “firmware update” phishing campaign.
Blockchain security firm SlowMist flagged the scam, sharing screenshots of an email which urges the recipient to connect their hardware wallet to “protect your device against emerging spyware threats, such as recent incidents in Malaysia.”
This type of phishing campaign is a common tactic employed by scammers looking to take advantage of the fear created by such incidents.
The campaign doesn’t currently appear on Ledger’s own “ongoing phishing scams” webpage, which instead warns of campaigns linked to previous data leaks.
SlowMist TI Alert
— SlowMist (@SlowMist_Team) October 16, 2026
A fake "Ledger firmware update" campaign is exploiting the recent @Ledger supply chain incident.
Looks very real: fake “Genuine check” page, device selection, “Update Now” button. Never click website links to update. Never enter your recovery phrase… pic.twitter.com/cwKfLIaQD4
Read more: Ledger says Southeast Asia reseller linked to $86M draining
Last week, reports of the mass-draining of Ledger devices were quickly linked to authorized reseller CryptoBilis, which operates in South East Asia.
Former CEO Arravind Prabu stated that the company was “acquired earlier this year,” with a confidentiality agreement in place “until Oct 19.”
After the company changed hands, former Mt. Gox CEO Mark Karpelès found devices fitted with spyware which tapped into the display unit before transmitting the data via a hidden SIM card.
Need free data? Buy a cheap ledger off a dodgy seller, pull the sim out of the spy implant and enjoy while you can (law enforcement may visit you thinking you are the one making these).https://t.co/ycMuv98UHh pic.twitter.com/4tVCkrqlF0
— Mark Karpelès (@MagicalTux) October 8, 2026
Read more: Ledger sued for $500M over its many data breaches
It appears that the looming deadline, together with Karpelès findings, prompted the spyware operators to pull the trigger on the operation, which claimed a total of $86 million in crypto.
Unconfirmed reports have since circulated of devices in other regions, with European reseller MediaMarkt suspending sales, and Ledger urging other distributors to do the same.
While it’s been a tough week for Ledger, bafflingly, the firm took the opportunity to announce a new device yesterday. The phone-like Atom is an Android device fitted with a data-only eSIM, which cannot make calls.
Read more: Ledger roasted over $849 device launch after $86M hack
No honor among thieves
According to crypto forensics firm Chainalysis, one of the largest (and potentially most dangerous) victims of the recent Ledger draining campaign was a “task scam” operator.
One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam.
— Chainalysis (@chainalysis) October 15, 2026
In this task scam, people were paid to fake sales and reviews of real items. Then a "negative balance" appeared, and they were told… https://t.co/IJX4tx9ib3 pic.twitter.com/pGXNJkZJUi
Read more: Ledger spyware scare spreads beyond Southeast Asia
The funds, which totalled “more than 60 BTC, about $4.8 million” were drained from three compromised Ledger devices and were the proceeds of a scam in which “people were paid to fake sales and reviews of real items” before being tricked into sending money in order to withdraw their payment.
The funds had been sent to the compromised devices just three weeks before being emptied during the October 9 mass draining event.
Chainalysis’ post was shared by Ledger CEO Pascal Gauthier, a move which wasn’t well received, to say the least.
One X user accused Gauthier of a lack of self-awareness, while another called for him to resign. A third said “Ledger truly deserves to go bankrupt.”
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.
The post Phishing scammers capitalise on Ledger panic with fake firmware update appeared first on Protos.