Hardware wallets like those provided by Ledger are a specific kind of bitcoin wallet that can store a user’s private and personal keys within a secured hardware device. Hardware wallets can have many benefits to users that are not offered by wallets using standard software – for example, private keys are commonly stored within the protected area of the device’s microcontroller, and therefore cannot be moved from the wallet in plaintext, optimising security.
The Ledger Nano S has earned a reputation as one of the most secure hardware wallets available for storing a wide range of cryptocurrencies, including BTC, ETC, ETH, Ripple, Dash, ZCas and Stratis, among many others. However, even Ledger itself admits that its users are often subjected to phishing attacks.
The support section of the Ledger site comments:
“Ledger users are continuously targeted by phishing attacks on social media, search engines and via email. Attackers are able to perfectly imitate Ledger’s website, content, or applications to lure users into entering their 24-word recovery phrase. Please be very cautious. If you’re asked to provide your recovery phrase OR to send crypto assets, it’s a malicious attack.”
A scam aimed at Ledger users
Individuals who use Ledger hardware wallets were recently assailed with a wave of insidious emails that have been investigated and identified as a scam. The malicious campaign involves two separate stages of email attacks and has been cleverly designed to create an atmosphere of panic. This is a common tool employed in phishing messages to make victims behave rashly and drive them to take harmful actions. This particular scam encouraged its targets to act quickly as their cryptocurrency was at risk and would be stolen.
In the first barrage of emails launched, requests were made for users to submit their Ledger hardware wallet recovery expression, which is comprised of 24-words. Ledger has confirmed publicly to users that this is a request it would never make. This initial attack was followed by a second wave of targeted phishing emails encouraging users to complete an installation of the latest edition of Ledger Live and then alter their Personal Identification Number (PIN). It stated that this was necessary as the data stored on Ledger servers had been compromised, impacting wallets linked with intended email addresses.
Keeping Ledger hardware wallets secure
Users should remember never to share their 24-word recovery phrase with others, as anyone with access can take control of their assets. To keep this phrase secure, users should never enter it onto any other piece of digital equipment except their Ledger device. Recovery phrases and PIN numbers will never be asked for by Ledger, so any requests should always be denied. To ensure any communications made are with legitimate representatives of the company, users should only ever use the official contact form on Ledger.com.
For further advice on safeguarding your enterprise from cyberthreats, you can rely our expert team at Galaxkey. Our cutting-edge security platform has been developed with powerful encryption, no stored passwords and zero backdoors for maximum protection. Contact us today for an online demonstration.
