Fake Ledger Site Tops Google Search: “Once the recovery phrase has been handed over, the wallet must be regarded as compromised”

Anyone searching for the software for a Ledger hardware wallet through a search engine can currently land on a copy. On Saturday the security researcher Cyber Scrilla reported a counterfeit Ledger site together with a matching app, which appeared high up in Google's organic results and asks visitors for their 24 words. Those 24 words are the access to the entire balance. Anyone who types them in loses control of the wallet, even if nobody ever had the device itself in their hands.

For holders in Germany what follows is not another checklist for suspicious emails but a habit: wallet software is reached through a bookmark or an address typed in yourself, never through the search box. This article sets out what has been reported, how a counterfeit gets to the top at all, and what to do if the phrase has already been entered.

Counterfeit Ledger site in Google search: what security researchers have reported

The report goes back to the security researcher Cyber Scrilla, who on Saturday pointed to a rebuilt Ledger site and an app belonging to it. Both are designed to ask for the 24-word recovery phrase. Coinfomania reports that the site gathered more than a million visits over the past month, and traces the figure back to Google data.

Caution is in order with that figure. Other reports from the same day take over the order of magnitude but write it down expressly as a claim and name no measurement basis of their own. What is robust is therefore the direction, not the decimal place: the counterfeit reached not a few dozen people but a number on the order of a mid-sized German city. The reports do not name the domain concerned, which makes checking harder for readers.

Also important for the assessment is what has not happened here. There is no indication that Ledger's hardware has a flaw or that the company has lost keys. What is under attack is the route to the manufacturer, not the product.

Recovery phrase: why 24 words are the actual point of attack

The recovery phrase, often called the seed phrase, is a list of usually 24 words from which all the private keys of a wallet can be calculated. This word list does not work like a password that can be reset. Whoever holds it holds the balance.

From that follows the hard rule behind every hardware wallet: the phrase never leaves the device and the piece of paper. No manufacturer, no support desk, no verification page and no update needs it. A hardware wallet is secure precisely because the keys never leave the device; an input field in the browser undoes that protection in a single step. It is kept offline, on paper or stamped metal, and in a place only the owner knows.

The forensic analyst Albert Quehenberger is quoted by BTC-Echo with the sentence: "Once the recovery phrase has been handed over, the wallet must be regarded as compromised." That is the technical consequence, not a formula of caution. An attacker who knows the words can rebuild the wallet on any device and has nothing further to overcome.

Search poisoning and malvertising: how a copy reaches the top of the results list

A fraudulent site standing at the top of search is no accident and no sign of a hacked search engine either. Two mechanisms work together here, and both are cheaper than many assume.

The first is paid placement. Whoever books an advertisement on a brand name lands above the first unpaid result. The security firm Zscaler had already found malicious Google adverts in September that passed themselves off as Ledger and led users to counterfeit verification pages; Coinfomania points to that in its report. Adverts are reviewed, but review takes time, and a few hours of run time are already enough.

The second is organic placement, and it explains the present case. A copy of the genuine site inherits its structure, its texts and its terms. If enough links from other sites are added, the search engine rates the copy as a fitting answer to a brand query. Specialists call that search poisoning: the results list stays technically correct, only at the top of it stands the wrong address.

On this hangs the insight that sets this case apart from the usual phishing waves. Until now search counted as the safe route and the unexpected email as the dangerous one. That order no longer holds. Anyone wanting to check which device and which software actually fit their own requirements will find the models with their differences in custody and operation in the hardware wallet comparison.

The invented deadline of October 15: how the Ledger emails are built

Alongside the counterfeit site, counterfeit emails are running. BTC-Echo describes messages that warn in Ledger's name of a security flaw and demand a manual security update by October 15, 2026. That deadline does not exist; it is the lever of pressure.

The pattern is well known in fraud research and doubly effective in this case, because an incident genuinely is under way. A real news situation makes the false email plausible. Added to that are counterfeit support requests in which, according to BTC-Echo, attackers pose as helpers after a supposed security incident and ask for credentials or have transactions approved.

Three features carry through almost every one of these emails: a date that creates haste, an action that is supposed to take place in the browser, and a request that goes beyond a plain login. If the date is missing, what remains is the demand to enter something that is otherwise never entered.

Ledger hack via the reseller CryptoBilis: what is established so far and what is not

The background against which the counterfeits are working so well just now is a second incident. Since October 9 Ledger has been investigating reports of emptied balances among customers who had obtained their devices in Southeast Asia through the reseller CryptoBilis. The onchain analyst Specter arrives, according to BTC-Echo, at more than $86 million said to have flowed out across several blockchains.

Honesty requires noting that BTC-Echo could not confirm that sum itself: the portfolio cited at Arkham Intelligence could not be found under the name given. A public statement of cause by Ledger is likewise still missing. What cryptoticker.io gathered on October 9, 2026 about the tampered devices and the halted reseller is set out in our account of the Ledger incident.

For owners in Germany this part stays manageable. CryptoBilis sold in Southeast Asia, not here. Ledger Support recommends, according to BTC-Echo, not setting up a device bought from this reseller in the past 90 days and, for devices already set up, moving the holdings to a new device with a new phrase. Anyone who bought their device from the manufacturer or from German specialist retail is not addressed by that recommendation.

How to proceed now if you have entered your recovery phrase

An entered phrase cannot be repaired. Such a sequence of words cannot be changed, blocked or recalled, and the time pressure is real: automated tools often clear out affected addresses within minutes.

The first step is a new wallet with a newly generated phrase, created on a device that never came into contact with the counterfeit. Only then are the holdings moved there, beginning with the largest position. Resetting the old device does not help, because the phrase is already out of the house. Nor does it help to keep watching the old wallet: whoever has the words needs no second attempt.

If it stayed at a click on the site, without any entry, nothing is lost. Then deleting files downloaded from such sources and a check of the approvals granted are enough. A phrase that was typed in nowhere remains a working phrase.

Bookmark instead of search box: how to reach Ledger Live and other wallet software safely

Against search poisoning, attentiveness helps little. What carries is a change in the order of things. The address of the manufacturer's site is entered manually once, checked carefully and saved as a bookmark. After that every visit starts at that bookmark, and search drops out entirely for this one purpose.

When first saving it, the spelling of the domain is worth a look. Interchangeable characters, additional syllables or a different ending are the usual craft. Anyone who has already saved the address does not have to read it again each time; that is precisely the gain.

The same applies to software wallets, and there the damage is often done faster, because the keys sit on the computer or the phone anyway. There the route by which the software is obtained decides who holds the keys in the end. A second principle gives additional protection: programs are obtained from the source that sits in the bookmark, and never from a search result.

Hardware wallet or exchange: where your coins should sit after this incident

Two incidents in the same week tempt one into a short circuit, namely pushing everything back onto an exchange. That calculation only works out if the risks are set cleanly against each other, because they are different, not simply larger or smaller.

With self-custody the risk lies with your own person: a lost phrase, a typed-in seed, a device from a doubtful source. That risk is manageable, but it is entirely yours. With an exchange it lies with the provider: insolvency, a halt on withdrawals, an incident at a service provider. That risk is not manageable, but a regulated counterparty with obligations stands liable for it.

In practice many holders separate by purpose. Amounts that are moved or traded stay with a provider under European supervision; amounts that are left lying go into self-custody. Which providers are authorised in the EU under MiCA and how they keep customer holdings is set out in the survey of regulated crypto exchanges. A MiCA authorisation says something about supervision and obligations, nothing about returns.

Our assessment: the search channel is the weak point, not the device

From the newsroom's point of view this case shifts the most important piece of advice for self-custody. The evidence for it lies side by side: a counterfeit at the top of the organic results with a visitor figure in the millions according to Coinfomania, plus the adverts leading to counterfeit verification pages documented by Zscaler in September. Both hit people who have done nothing wrong except search for a brand name.

What argues against drawing this case too large: the visitor figure is not independently verified, the domain is not publicly named, and how many visitors actually entered their phrase is unknown. Damage on the order of the reseller incident is not established for the counterfeit. The recommendation stays the same all the same, because it costs nothing: set a bookmark and stop using the search box for this purpose. Crypto balances can be lost in full, and with self-custody there is no body that replaces them.

Ledger phishing: no genuine deadline runs to October 15

The deadline in the emails is invented, the incident at the reseller is not yet cleared up, and the counterfeit site can reappear under a new address. Three steps bring your own custody to a state that survives this wave all the same.

1. Fix the route of access. Type the address of the manufacturer's site in manually once, check it and save it as a bookmark. Whether the current device fits your own requirements is shown by the hardware wallet comparison.
2. Tidy up software sources. Obtain wallet programs only from the saved source and remove installations that came from search results. The differences in key custody are set out in the software wallet comparison.
3. Split holdings by purpose. Keep trading amounts with a supervised provider, reserves in self-custody. Which houses are authorised in the EU is set out at the regulated crypto exchanges.

(As of October 10, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)