Blockchain security firm SlowMist has warned cryptocurrency users about a phishing campaign that impersonates an official Ledger firmware update, as scammers try to exploit the hardware implant incident linked to Southeast Asian reseller CryptoBilis. The firm said the fake pages closely imitate Ledger’s own processes and are designed to trick device owners into revealing their recovery phrases.
SlowMist, established in 2018, provides security audits, security consulting, and red teaming services. In a Threat Intelligence (TI) Alert posted on X on October 16, 2026, the firm said the fraudulent “Ledger firmware update” campaign is using the recent Ledger supply chain incident as a lure.
What the Fake Ledger Update Pages Show
According to SlowMist, the phishing pages include a fake “Genuine Check” page, a device selection interface, and an “Update Now” button. Genuine Check is the step Ledger uses to verify that a device is authentic, which makes the imitation harder for users to identify.
SlowMist advised users never to update Ledger devices through website links and never to enter their recovery phrase anywhere.
A recovery phrase, which Ledger calls a Secret Recovery Phrase (SRP), is a set of 24 words generated by the device during setup. Anyone who holds the phrase can restore the associated wallets on another device and move the funds. Ledger’s support guidance on fraudulent applications states that phishing sites impersonating its software often use urgent prompts such as “Update your firmware” to push users into entering the phrase.
Phishing Follows CryptoBilis Hardware Implant Incident
Ledger is a French manufacturer of hardware wallets, which are physical devices that store private keys offline and are used to authorize cryptocurrency transactions.
The campaign follows reports of fund losses among customers who bought Ledger devices from CryptoBilis, a reseller serving markets including Malaysia, Indonesia and the Philippines. Ledger said on October 9, 2026, that it was investigating the reports and had asked CryptoBilis to pause all sales and shipments of its devices.
On-chain analytics firm Bitquery estimated in its October 11 assessment that about $93.2 million had been stolen from 315 wallets across six blockchain networks. Ledger has not confirmed that figure. The Crypto Times earlier reported how the $93 million theft unfolded and how investigators traced the funds.
On October 10, Ledger confirmed that one of the impacted users’ devices contained an unauthorized hardware implant.
Ledger Calls It a Localized Distribution Attack
In a blog post published on October 15, 2026, Ledger said a highly organized criminal group spent many months buying genuine Ledger devices, opening them, fitting custom-built hidden components designed to capture the recovery phrase during setup, and returning them to distribution through resellers in Southeast Asia. The company described the incident as a localized distribution attack rather than a systemic supply chain attack, and said there was no flaw in its chip, operating system, or servers.
Ledger added that it had asked its authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong, and that it is working with law enforcement to trace the funds.
Ledger Donjon, the company’s in-house security research lab, said on October 13 that the implant reads the 24-word recovery phrase as it appears on the device screen during initial setup. It then transmits the phrase over Long Term Evolution (LTE), a cellular network standard, using an embedded Subscriber Identity Module (eSIM). According to Ledger, the implant does not modify the Secure Element, the chip that protects private keys, or the Ledger operating system. The Crypto Times previously detailed the Donjon findings and the unresolved reports of tampered devices in Europe and Asia.
How Ledger Users Can Identify the Scam
Legitimate firmware updates for Ledger devices are carried out through the official Ledger Wallet application, formerly known as Ledger Live, with the user confirming each step on the device itself. Ledger states on its phishing campaign tracker that it does not send emails asking users to update their device firmware.
Users who receive unsolicited messages or encounter websites offering firmware updates, Genuine Checks, or recovery phrase verification are advised to ignore them and report the activity through official Ledger Support channels.
Ledger’s investigation into the CryptoBilis incident is ongoing, and the company has said it will publish further details as they become available.
Also Read: Pirate Chain Exploit Mints 39.8M ARRR, Rollback Plan Dropped
