A shocking new phishing scam targeting Ledger hardware wallet users has been discovered — and this time, it didn’t arrive by email. Instead, scammers mailed a physical letter via the U.S. Postal Service (USPS), tricking unsuspecting users into compromising their cryptocurrency holdings.
Real Mail, Real Threat: What Happened?
According to Chris Dunn, a well-known crypto investor and educator, he received a fraudulent letter appearing to be from Ledger, the popular crypto hardware wallet manufacturer. The letter included a fake recovery sheet and instructions directing users to visit a phishing website under the pretense of a security update.
“This is by far the most sophisticated and dangerous phishing attempt I’ve seen yet,” Dunn stated on X (formerly Twitter).
The incident was confirmed by multiple users online, many of whom reported receiving similar USPS-delivered letters across the U.S.
How the Scam Works
The phishing attack involved a seemingly authentic Ledger-branded envelope with professional formatting. Inside was a message warning the user of a “data breach” and instructing them to input their 24-word recovery phrase into a fake recovery site.
“The scammers are counting on users panicking and entering their seed phrases, which would give the attackers full access to their funds,” said a cybersecurity expert at CertiK.
Ledger Responds to Phishing Attempt
Ledger quickly issued a public warning, reaffirming that:
- They never ask users to reveal their recovery phrase.
- Ledger does not send letters via USPS or any mail carrier.
- Users should only access Ledger services via official Ledger.com URLs.
“If you ever receive a letter, email, or phone call asking for your recovery phrase — it is a scam,” Ledger emphasized.
Crypto Community Urged to Stay Alert
This incident highlights a concerning trend: scammers are getting increasingly creative, targeting even the most cautious investors. By using physical mail, attackers are bypassing traditional digital protections and exploiting user trust in branded material.
This is a clear reminder: NEVER share your recovery phrase with anyone — online or offline.
Final Thoughts
The USPS phishing attack marks a new level of sophistication in crypto scams. As cryptocurrency adoption grows, so too do the efforts of malicious actors.
Stay informed, double-check all communications, and protect your seed phrase at all costs.