Why Hardware Wallet Owners Are on a List
A hardware wallet is very hard to hack remotely. That’s the point of owning one. So attackers don’t try. They go after the one thing the device can’t protect: you, and the 24 words you wrote down.
And they know exactly who to target, because the customer lists keep leaking:
- 2020: Ledger’s customer database leaked — first email addresses, then names, phone numbers and home addresses.
- January 2026: a breach at Ledger’s e-commerce partner Global-e exposed customers’ names, contact details and order information.
- August–September 2026: a breach at Trezor’s shipping provider ShipMonk exposed names, addresses, emails and phone numbers. Trezor first put the number of affected customers at nearly 14,000, then at about 81,000 after finding that ShipMonk had kept older US order data it had been required to delete.
None of these leaks exposed recovery phrases or funds. They didn’t need to. A list of people who own hardware wallets, with their home addresses, is all a scammer needs to start.
The Five Playbooks
1. Letters in the post
Branded letters, sometimes with holograms, announce a new “mandatory” security feature with a deadline. Ledger-themed letters announced a “Transaction Check” to be enabled by 15 October 2025. Trezor-themed letters reported in February 2026 announced an “Authentication Check” to be completed by 15 February 2026, “or risk losing device functionality.”
Each letter has a QR code. It leads to a polished site that walks you through “verification” and ends by asking for your 12-, 20- or 24-word recovery phrase “to confirm device ownership”. The words go straight to the attackers.
The Trezor version is especially cunning: Trezor Safe devices really do have an authentication check. It runs automatically in Trezor Suite when you set up a new device. It never involves a letter, a QR code or your recovery phrase.
2. Emails from the company’s real address
In June 2025, attackers abused Trezor’s own support contact form. By submitting requests on behalf of target email addresses, with manipulated subject lines, they triggered Trezor’s genuine automatic replies. The emails really did come from Trezor, and they led to phishing. Trezor said its systems weren’t breached.
The lesson is uncomfortable but important: a genuine sender address doesn’t make a message safe.
3. Fake apps
Security researchers at Moonlock tracked multiple campaigns from August 2024 onwards that replaced Ledger Live on Macs with malicious clones. One variant showed a fake “critical error” and asked the user to enter their 24-word recovery phrase to fix it.
Official app stores aren’t a guarantee either. In April 2026, a fake Ledger Live app on Apple’s App Store was linked by investigator ZachXBT to about $9.5 million stolen from more than 50 victims before Apple removed it.
Ledger renamed Ledger Live to Ledger Wallet in October 2025. Renames create confusion, and confusion creates “download the new version” scams.
4. Fake support on social media and search
Post a complaint about your device on X, Reddit or Discord and you’ll often get a fast, friendly reply from “Ledger Support” or “Trezor Help”. It’s a fake account. It will move you to a DM, a Telegram chat or a “support form” — and eventually to a page that wants your recovery phrase.
Search ads and fake phone numbers work the same way. Real support doesn’t find you; you find it.
5. Fake and “replacement” devices
In 2021, attackers mailed modified Ledger devices to customers whose addresses had leaked, with a letter saying their old device was unsafe. In October 2026, Ledger confirmed that devices sold through a Southeast Asian reseller contained hidden implants that captured the recovery phrase during setup. Ledger also warned that scammers would pose as Ledger to exploit the news. Expect unsolicited “replacement device” offers to follow every hardware wallet headline. Related: Is Your Hardware Wallet Genuine? What the October 2026 Implant Case Changed
Why These Scams Work on Careful People
The striking thing about hardware wallet phishing is who falls for it. These aren’t people who ignore security. They bought a hardware wallet precisely because they take it seriously — and the scams are designed around that.
- They’re framed as security. “Enable Transaction Check”, “complete your Authentication Check”, “verify your device after a breach”. The victim believes they’re doing the responsible thing, and refusing feels like negligence.
- They borrow real events. Breach notifications, product renames, genuine features and real news about tampered devices all make the pretext believable. The Trezor letters copied the name of a feature Trezor really has.
- They use real channels. A letter in your own letterbox, an email from the company’s genuine address, an app in an official store. Every signal people are taught to check has been faked or hijacked.
- They add a deadline. A date a few weeks away creates enough pressure to act without reflection, yet enough time to seem reasonable.
- They ask for the phrase last. By the time the page asks for your 24 words, you’ve already scanned the code, read the explanation and clicked through several steps. Stopping feels like wasting the effort.
Knowing the pattern makes it easier to stop at the one moment that matters: when anything, anywhere, asks for your recovery phrase.
The Rule That Beats All Five
Your recovery phrase goes into exactly two places: the hardware wallet itself, and the offline backup you made. Nowhere else, for anyone, ever.
Not into a website, an app on your computer or phone, a form, a chat, a phone call, or a “verification” step. Not even into the manufacturer’s real app.
Ledger states that it “will never send physical items or ask you to scan QR codes, visit websites, or share your 24-word recovery phrase.” Trezor says it will never ask for your wallet backup.
The rest follows from that rule:
- Real updates happen in the official app, and firmware updates are confirmed on the device’s own screen.
- Real security features don’t come with deadlines and threats. “Complete this by Friday or lose access” is a pressure tactic, not a product announcement.
- Real support never contacts you first about a problem with your device.
How to Reach Real Support
- Ledger: type support.ledger.com into your browser.
- Trezor: type trezor.io/support into your browser.
Don’t use phone numbers or links from search results, ads, social media replies or emails. Don’t post device problems publicly. And if you do talk to support, remember that no support agent needs your recovery phrase to help you.
Make Your Household Phishing-Resistant
Letters and calls don’t only reach you. A partner, parent or teenager who opens the post or answers the phone can be the weak link — especially if they help manage family crypto.
- Tell everyone in your household the one rule: the recovery phrase never goes anywhere except the device and the backup.
- Agree that any message about crypto accounts or devices comes to you first, unanswered and with nothing scanned or clicked.
- If you help an older relative with self-custody, set up their device in person, with them, and show them what the letter scam looks like.
If You’ve Already Typed Your Recovery Phrase Somewhere
Act now, and assume the worst:
- Treat the wallet as compromised. Changing your PIN doesn’t help; whoever has your words has your wallet.
- Set up a new wallet with a new recovery phrase, on a device you trust, and move everything to it immediately.
- Don’t reuse anything from the old setup: not the recovery phrase, not the passphrase.
- Beware of “recovery” services. Anyone offering to get your crypto back for a fee is very likely running a second scam. Related: Your Crypto Was Just Stolen: What to Do in the First 24 Hours
If you received a phishing letter or email, report it to the manufacturer and, in the Netherlands, to the Fraudehelpdesk (fraudehelpdesk.nl). Then destroy it.
Quick Checklist
- ☐ I have never typed my recovery phrase into any computer, phone or website
- ☐ I installed Ledger Wallet or Trezor Suite from the manufacturer’s own website
- ☐ I reach support only by typing the address myself
- ☐ I ignore letters, QR codes and “mandatory” deadlines from anyone
- ☐ I treat messages from a company’s real email address with the same suspicion as any other
Frequently Asked Questions
I got a letter that looks exactly like Ledger’s branding. Could it be real?
No. Ledger says it never sends physical items or asks you to scan QR codes. Throw it away, or report it and then destroy it.
The email came from Trezor’s real address. Is it safe?
Not necessarily. In 2025, attackers made Trezor’s own systems send emails that led to phishing. Judge a message by what it asks for, never by who it appears to come from.
Will Ledger or Trezor ever call me?
Don’t expect them to, and never act on a call you didn’t initiate. Hang up, and contact support yourself through the official website.
My details were in one of the leaks. What should I do?
Expect more phishing, by email, phone and post. Never act on unsolicited messages, consider moving if you have reason to fear physical targeting, and keep your recovery phrase offline. Related: Your Data Is the Attack Surface: How Breaches, KYC and Tax Records Make You a Target
Transparency: TrueToCrypto may earn affiliate commissions from links in articles; this article contains none. This article is educational and is not financial or security consulting advice.
Contact: info@truetocrypto.com
Sources: BleepingComputer (February 2026) on phishing letters; The Block (23 June 2025) on the Trezor contact-form abuse; Moonlock via Cyber Security News (May 2025); The Block and BleepingComputer (April 2026) on the fake App Store app; The Register (6 January 2026) on Global-e; BleepingComputer (7 September 2026) on the ShipMonk breach; Ledger statements (October 2026). Verified October 2026.
