Fake Ledger firmware updates: SlowMist reports phishing pages with a replica Genuine Check

No genuine Ledger firmware update asks for your 24 words. That is precisely what a phishing campaign attempts, one the security firm SlowMist reported on October 16, 2026 through its threat intelligence channel on X. The fake pages reproduce the sequence of an official update, right down to Ledger's real authenticity check, and at the end comes the prompt to type in the recovery words. Anyone who does loses access to every balance attached to that wallet.

The timing is no accident. Since October 9, the examination of an incident has been under way in which tampered Ledger devices reached the market through an authorised reseller in South-East Asia. That case has left many hardware wallet owners feeling, for the first time in years, that they need to check their device. This uncertainty is the raw material from which the operators of the fake pages draw their reach.

The method: a fake firmware update asks for the 24 words

The pages SlowMist describes are not crudely assembled forms. According to the report they lead through three stations: a replica page for the so-called Genuine Check, a choice of device model and a button labelled "Update Now". Only then comes the decisive request, the entry of the recovery words.

This structure is deliberate. It mirrors the order an owner expects from a real update, and it puts the critical question right at the end, once trust has been built by the preceding steps. SlowMist names no domain names for the fake pages in the report and does not say by which route owners end up there. What is substantiated is the sequence, not the distribution channel.

What the recovery phrase is, technically

The recovery phrase, often also called a seed phrase, is a sequence of 24 words generated when a Ledger device is set up. It is the mathematical root of every key pair that device manages. Anyone who knows those words can restore the wallets on any other device and move the balances without ever holding the original device. A PIN is no protection against that, because the PIN locks only the device, not the words.

From that comes the only rule that counts on this subject: the 24 words are displayed once during setup and never requested again, by no page, no app and no support agent. Every request is an attack, however good the page looks.

Genuine Check: the replica authenticity check is the bait

The Genuine Check is not a term the attackers invented but a real step at Ledger. In it, the device proves to Ledger's servers that an unaltered secure element sits inside it. Owners know the step because it runs in the background during setup and during updates.

It is that very familiarity which makes the replica effective. A page that picks up a term from the real sequence looks more credible at first glance than an invented interface. Someone used to an authenticity check coming first reads it as confirmation rather than as part of the deception. Added to that, many owners have been looking for a way to verify their device anyway after the reports of recent days.

CryptoBilis: the hardware implant the campaign uses as bait

The incident the phishing wave builds on began with reports of losses among the customers of one reseller. In its statement, Ledger names CryptoBilis, an authorised reseller for Indonesia, Malaysia and the Philippines, as the channel through which tampered devices went on sale. Ledger has asked the reseller to suspend sales and shipping and has opened an investigation. Whether the reseller knew of the tampering, Ledger does not say; no such finding has come from any quarter so far.

On Ledger's account, a criminal group bought genuine devices over months, opened them and inserted purpose-built, hidden components. Those components were designed to capture the recovery phrase during setup. The devices then went back on sale. Ledger's security laboratory Donjon has taken one such implant apart and established how it works.

Ledger's statement of October 15: a "localized distribution attack"

Ledger set out its reading of the incident in its own post on October 15, 2026. The central sentence runs: "This was not a systemic supply chain attack, it was a localized distribution attack." In other words, the company sees no attack on the supply chain as a whole but an intervention in the distribution route, after the devices had left its sphere of control. Ledger writes further: "There was no flaw in Ledger's chip, operating system or servers", and: "Ledger's systems were not compromised."

For owners in Germany, the same statement carries one detail that touches them directly. Ledger sent its own teams into local markets, expressly including Germany, bought devices in shops there and opened them, and examined samples from warehouse stock. The company sums up the result with the sentence "Every unit examined was clean". In addition, Ledger has asked authorised resellers and distributors to suspend sales in South-East Asia and Hong Kong.

These statements come from the manufacturer itself and are not an examination by an independent body. They are nonetheless the most precise public description of the incident available, and they narrow the affected area geographically.

$86 million to $93.2 million: the range of the estimates

Two figures are available for the scale of the losses, and they differ. The analytics firm Bitquery arrived at around $93.2 million in an assessment dated October 11, 2026, drained from 315 wallets across six different blockchains. Beside it stands a lower count of roughly $86 million, which on-chain analysts worked out from the attackers' collection addresses and which we reported on October 10.

Both values are estimates from blockchain analysis, not confirmed accounts. Ledger itself has not confirmed Bitquery's figure. The range therefore stands, and it can shift upwards as further addresses are attributed.

Why loss figures grow in incidents of this kind

With an implant that captures words during setup, a long stretch of time often lies between the theft of the data and the draining of the balance. Attackers can wait until an address holds an amount worth taking. An assessment on a given date therefore captures only the wallets emptied by then, not every compromised device.

The real update route runs through the Ledger app, not through a link

A firmware update for a Ledger device runs through the manufacturer's companion app on a computer or smartphone, long known as Ledger Live. The app recognises the connected device, downloads the update and requires confirmation at every step on the device display itself. That display is the point at which you check what is actually happening, because it is generated by the device and not by a web page.

SlowMist sets out two recommendations in the report that address exactly this: never update Ledger devices through links on web pages, and never enter the recovery phrase anywhere. Both sentences sound banal and still go to the heart of it, because the fake pages draw their whole effect from the confusion of browser with device.

Five hallmarks of the fake update pages

• The page asks for the 24 words to be typed into a form field. That point alone settles everything.
• The sequence starts in the browser instead of in the manufacturer's installed app.
• Time pressure is built up, for instance through the claim that the device is unsafe without the update.
• The entry point came through a link in a message, an advertisement or a search result.
• The page requires no confirmation on the device display, although it claims to be carrying out an update.

The fake page we reported on October 11 rose through Google search and shows that the entry route keeps changing. The request for the words, by contrast, stays constant, and every variant can be recognised by it. More on the patterns is in our analysis of the fake Ledger page in Google search.

Self-custody or regulated custody: the trade-off for investors in Germany

The incident shifts a question many considered settled. A hardware wallet takes the counterparty risk of an exchange off your hands and puts two other risks on you instead: the security of your purchase route and the security of your 24 words. The implant case shows that the purchase route is no theoretical risk, and the current phishing wave shows the same for the words.

None of that is an argument against self-custody, but one for a deliberate split. If you hold larger amounts yourself, buy devices directly from the manufacturer or from authorised resellers and set them up so that the words never leave the device in digital form. Hand custody over instead, and you end up with providers who need authorisation for the custody business in the EU, trading one risk for another. How the devices differ is shown in our hardware wallet comparison.

Retailers in Germany have partly halted sales

The incident has reached German retail as well. MediaMarkt and Saturn have suspended sales of Ledger devices, which we reported on October 14. Ledger, for its part, presented a new device called Atom on October 15 which, the manufacturer says, would prevent implants of this kind through a different setup route.

For the decision now at hand, that is a footnote. What remains decisive is where a device comes from and whether the words have ever reached an input field. We have recorded the state of the investigation in our report on Ledger's confirmation of the implant.

Trezor, SafePal and BitBox: the same logic hits other makers too

The request for recovery words is not a Ledger problem but the shared aim of every attack on hardware wallets. Recent weeks brought comparable occasions at other providers, among them a data leak at a logistics contractor of Trezor's and a data leak at SafePal, which we reported on September 13 and October 11. In neither case was the device the way in, but the list of customer addresses, which then served for targeted approaches.

The mechanism repeats itself: a public incident creates uncertainty, and within days pages and messages appear that translate that uncertainty into an action. Once you know the pattern, the particulars of any given campaign no longer matter, because the final question is always the same.

What is still possible once the phrase has been entered

If the 24 words have been typed into someone else's page, the wallet counts as open. Then speed is what matters: set up a new device with a newly generated phrase and move the balances to the new addresses before the attackers do. The old phrase is never used again, not even for a single asset, because it covers every address derived from it. A restore on the same device does not solve the problem, because the problem is the phrase and not the hardware.

The key points from the SlowMist report

On October 16, 2026, SlowMist reported a phishing campaign that reproduces a Ledger firmware update and imitates Ledger's real Genuine Check in order to ask, at the end, for the 24 recovery words. The campaign uses the implant incident at the reseller CryptoBilis as bait. Ledger characterised the incident on October 15 as a "localized distribution attack", denied any flaw in chip, operating system and servers, and stated that devices bought and opened in Germany as well were clean. Estimates of the losses lie between roughly $86 million and $93.2 million. The countermeasure is the same in both cases: updates only from the manufacturer's app, and the words belong in no input field.

Ledger phishing: no genuine update asks for your 24 words

1. Update only from the manufacturer's installed app. Connect the device, start the companion app and confirm every step on the device display. If an update notice arrives by email, advertisement or search result, ignore the link and open the app yourself. Which devices use which setup route is set out in the hardware wallet comparison.
2. Check where your device came from. Devices from the manufacturer or from authorised resellers are the normal case; offers from secondary markets and unknown traders are not. With a second-hand device, set it up using a newly generated phrase. For the software side of custody, the software wallet comparison helps.
3. Decide which part of your holdings sits where. Set out what sum you hold yourself and what sits with an authorised provider, and write the decision down. An overview of the venues authorised in the EU is at regulated crypto exchanges.

Sources: Ledger's statement of October 15, 2026 and the report on the SlowMist disclosure of October 16, 2026.

(As of October 16, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)