Bogus Ledger firmware update lure follows $86M spyware heist

Scammers are exploiting the recent $86 million Ledger spyware scandal with a new phishing campaign built around a fake “firmware update.”

The scheme was flagged by blockchain security firm SlowMist, which shared screenshots of an email telling recipients to connect their hardware wallet to “protect your device against emerging spyware threats, such as recent incidents in Malaysia.”

Feeding on the fear generated by such events is a standard phishing tactic, and the new campaign follows that pattern.

The campaign does not yet show up on Ledger’s “ongoing phishing scams” webpage. That page currently warns of schemes linked to previous data leaks.

SlowMist TI Alert

A fake "Ledger firmware update" campaign is exploiting the recent @Ledger supply chain incident.

Looks very real: fake “Genuine check” page, device selection, “Update Now” button. Never click website links to update. Never enter your recovery phrase…

— SlowMist (@SlowMist_Team) October 16, 2026

Last week’s reports of Ledger devices being drained on a large scale were quickly tied to authorized reseller CryptoBilis, which operates in South East Asia.

Arravind Prabu, who previously led the company, said it was “acquired earlier this year,” under a confidentiality agreement in place “until Oct 19.”

Mark Karpelès, the former Mt. Gox chief executive, found after the deal closed that some devices were carrying spyware; it intercepted what appeared on the display and sent the data out through a hidden SIM card.

Need free data? Buy a cheap ledger off a dodgy seller, pull the sim out of the spy implant and enjoy while you can (law enforcement may visit you thinking you are the one making these).

— Mark Karpelès (@MagicalTux) October 8, 2026

Karpelès’ discoveries, along with the looming deadline, appear to have pushed the spyware operators to set the scheme in motion — a scheme that ultimately drained $86 million in crypto.

Since then, unconfirmed word has spread of affected devices in other regions; European reseller MediaMarkt has paused sales, and Ledger has asked other distributors to do likewise.

Oddly, after a bruising week, Ledger used yesterday to unveil a new device. Called the Atom, the phone-like gadget is an Android handset with a data-only eSIM, ruling out phone calls.

No honor among thieves

Among the biggest and potentially most dangerous victims of the recent Ledger draining campaign, according to crypto forensics firm Chainalysis, was a “task scam” operator.

One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam.

In this task scam, people were paid to fake sales and reviews of real items. Then a "negative balance" appeared, and they were told…

— Chainalysis (@chainalysis) October 15, 2026

Those funds, pulled from three compromised Ledger devices, amounted to “more than 60 BTC, about $4.8 million” and represented the proceeds of a scheme in which “people were paid to fake sales and reviews of real items” and were then tricked into sending money in order to withdraw their payment.

That money reached the compromised devices a mere three weeks before the October 9 mass draining event emptied them.

Pascal Gauthier, Ledger’s chief executive, shared Chainalysis’ post, a move that went down poorly, to say the least.

One X user accused Gauthier of a lack of self-awareness, another called for his resignation, and a third said “Ledger truly deserves to go bankrupt.”