QUADRIGA INITIATIVE
CRYPTO WATCHDOG & FRAUD RECOVERY PLATFORM
A COMMUNITY-BASED, NOT-FOR-PROFIT
UNKNOWN
MARCH 2021
GLOBAL
LEDGER
DESCRIPTION OF EVENTS
"Based in France, Ledger is the largest cryptocurrency hardware wallet company." "Ledger is a hardware cryptocurrency wallet that is used to store, manage, and sell cryptocurrency. The funds held in these wallets are secured using a 24-word recovery phrase and an optional secret passphrase that only the owner knows."
"Ledger offers two products, the Nano S and Nano X, that can store the digital keys used to secure crypto wallets. The devices can be used with a variety of cryptocurrencies, are compatible with numerous apps, and are supposed to offer a safe way to manage crypto without compromising too much on convenience. Ledger says on its website that it has sold 1.5 million products to customers in 165 countries to date."
"Amazon store branding is not as easy as just "calling your store" this or that. Only official brands can create OFFICIAL Amazon Stores. In order to create The official Ledger Store on Amazon, or ANY BRAND in fact, the brand itself would have to send in legal paperwork, and trademark documentation to verify they are the real brand. The issue people are having is clearly that Amazon resells returned fulfilled by amazon items. Amazon does this with any FBA products and obviously doesn't understand how sensitive this item particularly was."
"One of [Ledger's] user[s] got recently scammed on Amazon. The user bought a Ledger Nano S which had already been initialized by a malicious seller. The malicious seller sent a Nano already initialized to the user with a recovery sheet filled with the 24 words."
"Today I received my brand new Ledger Nano S from Amazon (from Ledger's store). The box had security seals and inside there was an envelope with a security seal as well."
"When I opened the envelop, I found 3 sheets for the recovery phrase empty, and a laminated sheet with a PIN and a 24 word recovery phrase."
"You guessed it, when I started the device, the first thing it did was ask me for the PIN found in the laminated sheet."
"When a user receives its Ledger wallet, whether it is a Nano S or X, she/he must always initialize first it by [p]owering on the device, [g]enerating a pin code by himself/herself, [and g]enerating the 24 words (seed phrase) by himself."
"We recently learned from Amazon that the product you received is likely not a new condition Ledger product but rather a product returned to and re-stocked by Amazon, despite our instructions to Amazon not to restock returned products."
"An investigation suggests that it might have been part of a batch of products that may have been tampered with by criminals. By abundance of caution, we wanted to contact every user that we suspect may be impacted."
"[N]o pin code or seed phrase should ever be given to the user by anybody else prior to the initializatio[n]."
Ledger authorized some hardware wallets for resale through Amazon. Amazon allowed returns of these products by mistake. As a result, criminals added seed phrases and returned the hardware wallets. This resulted in customers receiving official wallets with seed phrases already provided. It appears that at least one user got scammed and lost funds, though the details are not known.
HOW COULD THIS HAVE BEEN PREVENTED?
The safest strategy is to always buy the hardware wallet directly from Ledger and always be sure to initialize it with a newly generated seed phrase. While it is unlikely that someone who had tampered with a Ledger device would also send a seed phrase with the package, anything is possible.
When setting up a new wallet of any sort, it is also a good practice to only transfer a small quantity of funds first, transferring the rest if those funds remain safe. This minimizes damage from any theft incident involving immediate removal of the funds. Advanced users may also set up a multi-sig with hardware wallets from different manufacturers all required to sign the outgoing transaction. You should also test the wallet to make sure that you can withdraw funds and didn't make a mistake in the setup.
@Ledger Twitter (Jan 31)
@btcriku Twitter (Jan 31)
Ledger Won’t Reimburse Users After Major Data Hack - Decrypt (Jan 31)
Ledger Faces Class-Action Lawsuit for 2020 Data Breach (Jan 31)
After Ledger Hack, Who Can You Trust For Bitcoin Storage? (Jan 31)
Ledger Hack: Who is Ledger? What Happened? Does the Ledger data breach affect everyone? - YouTube (Jan 31)
Ledger Hack: Am I Affected? Find Out if YOU or a Friend are Affected by the Ledger Data Breach - YouTube (Jan 31)
https://www.cryptovantage.com/news/is-ledger-still-safe-everything-we-learned-from-last-years-hack/ (Jan 31)
Ongoing phishing campaigns | Ledger (Feb 5)
Ledger Live : Most trusted & secure crypto wallet | Ledger (Feb 13)
Amazon Ledger Scam : ledgerwallet (Feb 13)
I think my ledger was compromised : ledgerwallet (Feb 13)
Imgur: The magic of the Internet (Feb 13)
https://www.amazon.com/dp/B07FY5R77T (Feb 13)
Bought ledger off amazon is it safe? : ledgerwallet (Feb 13)
Ledger Breach Vastly Underestimated, 270,000 Clients Data Leaked - Crypto Briefing (Jan 30)
Ledger Adds Bitcoin Bounty and New Data Security After Hack - CoinDesk (Jan 31)
Ledger Customers Targeted by ‘Convincing’ Phishing Attack - CoinDesk (Feb 27)
Update: Efforts to Protect Your Data and Prosecute The Scammers | Ledger (Feb 27)
Ledger data leak: A ‘simple mistake’ exposed 270K crypto wallet buyers (Feb 27)
6 Ways to Face the Data Breach | Ledger (Jan 31)
Ledger Hack Victim Scam Details - Bitcoin Magazine: Bitcoin News, Articles, Charts, and Guides (Jan 31)
Cybercrooks Are Mailing Users Fake Ledger Devices To Steal Their Cryptocurrency (Mar 6)
Scammers Are Sending Ledger Users Fake Hardware Wallets (Mar 6)
@BTChip Twitter (Feb 13)
Nasty Ledger wallet scams. And how to avoid them. - Who Took My Crypto (Mar 20)
6 Ledger Wallet Scams That You Should Know About - CryptoSec (Mar 20)
Life as a “Ledger” Wallet Data Breach Victim (Feb 27)
Slévárna: HARDWARE WALLET THREATS AND VULNERABILITIES - Peter Todd - YouTube (Oct 13)
