Ledger Fake Google Chrome Extension - Revision history

Azoundria at 20:05, 10 May 2024

2024-05-10T20:05:05Z

← Older revision		Revision as of 14:05, 10 May 2024
Line 4:		Line 4:
	[[File:Ledger.jpg\|thumb\|Ledger]]A number of malicious Google Chrome extensions were created in March 2020, which claim to be official Ledger Live wallets. The extension is also set up on Google to show up as an advertisement in the search results. During the supposed wallet setup process, users are requested to enter their seed phrase, which is sent to the attacker via a Google Form. The seed phrases can be used by the attacker to empty victim wallets and take their funds. There is a report of at least $2.5m worth of XRP being taken, while the amount of any other funds is less certain.		[[File:Ledger.jpg\|thumb\|Ledger]]A number of malicious Google Chrome extensions were created in March 2020, which claim to be official Ledger Live wallets. The extension is also set up on Google to show up as an advertisement in the search results. During the supposed wallet setup process, users are requested to enter their seed phrase, which is sent to the attacker via a Google Form. The seed phrases can be used by the attacker to empty victim wallets and take their funds. There is a report of at least $2.5m worth of XRP being taken, while the amount of any other funds is less certain.

	This is a global/international case not involving a specific country.<ref name="cointelegraphtwitter-6706" /><ref name="cointelegraph-6707" /><ref name="cointelegraph-6907" /><ref name="nakedsecurity-6908" /><ref name="danfinlaytwitter-6909" /><ref name="financemagnates-6910" /><ref name="ledgersupporttwitter-6911" /><ref name="xrpforensicstwitter-6912" /><ref name="reddit-6913" /><ref name="cointelegraph-6914" /><ref name="cryptoglobe-6915" /><ref name="tokenpost-6916" /><ref name="reddit-6917" /><ref name="zdnet-6918" /><ref name="snikotwitter-6919" /><ref name="whotookmycrypto-7313" /><ref name="cointelegraph-8286" /><ref name="toshitimesforum-8847" /><ref name="mycryptomedium-8842" /><ref name="invezz-8843" /><ref name="mycryptomedium-8844" /><ref name="googlesupport-8845" /><ref name="reddit-8846" />		This is a global/international case not involving a specific country.<ref name="cointelegraphtwitter-6706" /><ref name="cointelegraph-6707" /><ref name="cointelegraph-6907" /><ref name="nakedsecurity-6908" /><ref name="danfinlaytwitter-6909" /><ref name="financemagnates-6910" /><ref name="ledgersupporttwitter-6911" /><ref name="xrpforensicstwitter-6912" /><ref name="reddit-6913" /><ref name="cointelegraph-6914" /><ref name="cryptoglobe-6915" /><ref name="tokenpost-6916" /><ref name="reddit-6917" /><ref name="zdnet-6918" /><ref name="snikotwitter-6919" /><ref name="whotookmycrypto-7313" /><ref name="cointelegraph-8286" /><ref name="toshitimesforum-8847" /><ref name="mycryptomedium-8842" /><ref name="invezz-8843" /><ref name="mycryptomedium-8844" /><ref name="googlesupport-8845" /><ref name="reddit-8846" /><ref name="comparitech-10032" /><ref name="mycryptoblog-10095" />

	== About Ledger ==		== About Ledger ==
Line 176:		Line 176:
	<ref name="googlesupport-8845">[https://support.google.com/chrome/thread/39247659 My money from my ethereum account were stolen after I acceded the account via MEW CX extension. - Google Chrome Community] (Aug 22, 2022)</ref>		<ref name="googlesupport-8845">[https://support.google.com/chrome/thread/39247659 My money from my ethereum account were stolen after I acceded the account via MEW CX extension. - Google Chrome Community] (Aug 22, 2022)</ref>

	<ref name="reddit-8846">[https://redd.it/fws38m Downloaded new KeepKep Client, my funds were stolen 10 Minutes Later... Who do I vengefully hunt down?! : keepkey] (Aug 22, 2022)</ref></references>		<ref name="reddit-8846">[https://redd.it/fws38m Downloaded new KeepKep Client, my funds were stolen 10 Minutes Later... Who do I vengefully hunt down?! : keepkey] (Aug 22, 2022)</ref>

			<ref name="comparitech-10032">[https://www.comparitech.com/crypto/cryptocurrency-scams/ Worldwide crypto & NFT rug pulls and scams tracker - Comparitech] (Dec 15, 2022)</ref>

			<ref name="mycryptoblog-10095">[https://blog.mycrypto.com/2019-in-review--major-blockchain-crypto-security-incidents 2019 In Review: Major Blockchain/Crypto Security Incidents \| MyCrypto Blog] (Dec 28, 2022)</ref></references>

Azoundria at 19:30, 1 May 2023

2023-05-01T19:30:19Z

← Older revision		Revision as of 13:30, 1 May 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/ledgerfakegooglechromeextension.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/ledgerfakegooglechromeextension.php}}
	{{Unattributed ~~Citations~~}}		{{Unattributed Sources}}

	[[File:Ledger.jpg\|thumb\|Ledger]]A number of malicious Google Chrome extensions were created in March 2020, which claim to be official Ledger Live wallets. The extension is also set up on Google to show up as an advertisement in the search results. During the supposed wallet setup process, users are requested to enter their seed phrase, which is sent to the attacker via a Google Form. The seed phrases can be used by the attacker to empty victim wallets and take their funds. There is a report of at least $2.5m worth of XRP being taken, while the amount of any other funds is less certain.		[[File:Ledger.jpg\|thumb\|Ledger]]A number of malicious Google Chrome extensions were created in March 2020, which claim to be official Ledger Live wallets. The extension is also set up on Google to show up as an advertisement in the search results. During the supposed wallet setup process, users are requested to enter their seed phrase, which is sent to the attacker via a Google Form. The seed phrases can be used by the attacker to empty victim wallets and take their funds. There is a report of at least $2.5m worth of XRP being taken, while the amount of any other funds is less certain.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="cointelegraphtwitter-6706" /><ref name="cointelegraph-6707" /><ref name="cointelegraph-6907" /><ref name="nakedsecurity-6908" /><ref name="danfinlaytwitter-6909" /><ref name="financemagnates-6910" /><ref name="ledgersupporttwitter-6911" /><ref name="xrpforensicstwitter-6912" /><ref name="reddit-6913" /><ref name="cointelegraph-6914" /><ref name="cryptoglobe-6915" /><ref name="tokenpost-6916" /><ref name="reddit-6917" /><ref name="zdnet-6918" /><ref name="snikotwitter-6919" /><ref name="whotookmycrypto-7313" /><ref name="cointelegraph-8286" /><ref name="toshitimesforum-8847" /><ref name="mycryptomedium-8842" /><ref name="invezz-8843" /><ref name="mycryptomedium-8844" /><ref name="googlesupport-8845" /><ref name="reddit-8846" />
	<ref name="cointelegraphtwitter-6706" /><ref name="cointelegraph-6707" /><ref name="cointelegraph-6907" /><ref name="nakedsecurity-6908" /><ref name="danfinlaytwitter-6909" /><ref name="financemagnates-6910" /><ref name="ledgersupporttwitter-6911" /><ref name="xrpforensicstwitter-6912" /><ref name="reddit-6913" /><ref name="cointelegraph-6914" /><ref name="cryptoglobe-6915" /><ref name="tokenpost-6916" /><ref name="reddit-6917" /><ref name="zdnet-6918" /><ref name="snikotwitter-6919" /><ref name="whotookmycrypto-7313" /><ref name="cointelegraph-8286" /><ref name="toshitimesforum-8847" /><ref name="mycryptomedium-8842" /><ref name="invezz-8843" /><ref name="mycryptomedium-8844" /><ref name="googlesupport-8845" /><ref name="reddit-8846" />

	== About Ledger ==		== About Ledger ==
Line 85:		Line 84:
	!Description		!Description
	\|-		\|-
	\|March 4th, 2020 4:45:00 PM		\|March 4th, 2020 4:45:00 PM MST
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 93:		Line 92:
	\|		\|
	\|}		\|}

			== Technical Details ==
			This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

	== Total Amount Lost ==		== Total Amount Lost ==
Line 112:		Line 114:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
			Always check and visit the official website of a service. The majority of funds should be stored offline and not on a live wallet application. When setting up a new wallet or upgrading wallet software, never enter your pass phrase or send any funds without first transferring a smaller amount.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

	== Prevention ~~Policies ==~~		{{Prevention:Regulators:End}}
	Always check and visit the official website of a service. The majority of funds should be stored offline and not on a live wallet application. When setting up a new wallet or upgrading wallet software, never enter your pass phrase or send any funds without first transferring a smaller amount.

	== References ==		== References ==

Azoundria at 17:14, 17 February 2023

2023-02-17T17:14:44Z

Show changes

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/ledgerfakegooglechromeextension.php}} LedgerA number of malicious Google Chrome extensions were created in March 2020, which claim to be official Ledger Live wallets. The extension is also set up on Google to show up as an advertisement in the search results. During the supposed wallet setup process, users are requested to enter their seed phrase, which is sent to the att..."

2023-01-25T17:15:08Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/ledgerfakegooglechromeextension.php}} thumb|LedgerA number of malicious Google Chrome extensions were created in March 2020, which claim to be official Ledger Live wallets. The extension is also set up on Google to show up as an advertisement in the search results. During the supposed wallet setup process, users are requested to enter their seed phrase, which is sent to the att..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/ledgerfakegooglechromeextension.php}}

[[File:Ledger.jpg|thumb|Ledger]]A number of malicious Google Chrome extensions were created in March 2020, which claim to be official Ledger Live wallets. The extension is also set up on Google to show up as an advertisement in the search results. During the supposed wallet setup process, users are requested to enter their seed phrase, which is sent to the attacker via a Google Form. The seed phrases can be used by the attacker to empty victim wallets and take their funds. There is a report of at least $2.5m worth of XRP being taken, while the amount of any other funds is less certain.

This is a global/international case not involving a specific country.

== About Ledger ==
"Based in France, Ledger is the largest cryptocurrency hardware wallet company." "Ledger is a hardware cryptocurrency wallet that is used to store, manage, and sell cryptocurrency. The funds held in these wallets are secured using a 24-word recovery phrase and an optional secret passphrase that only the owner knows."

"Ledger offers two products, the Nano S and Nano X, that can store the digital keys used to secure crypto wallets. The devices can be used with a variety of cryptocurrencies, are compatible with numerous apps, and are supposed to offer a safe way to manage crypto without compromising too much on convenience. Ledger says on its website that it has sold 1.5 million products to customers in 165 countries to date."

"Online scammers have been targeting other popular crypto companies to impersonate their apps on Google and steal money from users." "The extensions he discovered impersonated well-known crypto firms such as Ledger, KeepKey, MetaMask and Jaxx. Their purpose is to trick users into giving away the credentials needed to access their wallets." "In early March, leading cryptocurrency hardware-wallet producer Ledger warned its users about the phishing extensions on the store."

"Ledger’s Twitter account warned users of fraudulent Chrome Extensions on March 5." "[A]ccording to Denley, the extension is also heavily advertised via Google ads for the keywords "Ledger Live," the Ledger service it's trying to impersonate."

"Leannekera said that sick, and in the isolation of quarantine, she made the decision to consolidate her Cryptocurrencies into Bitcoin as “money is tight,” and she believed that the consolidation would “recoup around 20%” of her and her husband’s losses."

"I’m self isolated as I am one of the many victims of Covid-19. I’m confined to a room in our house while my husband who is a key worker, continues to leave for work each day during the UK’s first lockdown. He’s an absolute hero, but I desperately wish our circumstances where different. I desperately wish I could just hug him."

"I have little but a laptop to keep me sane during the day at the minute, so I am frequenting Reddit often and keeping an eye on the crypto markets. Due to the situation right now money is tight, however I had worked out that by consolidating a few of our other crypto I would be able to recoup around 20% of our losses to help."

"A fake Chrome extension has been found, asking to enter your 24 word recover phrase."

“I recalled the Ledger having a Chrome extension and this is when the scam starts,” she wrote.

"The scam was particularly malicious because of steps that hackers may have taken to make it appear to be legitimate: “the only ledger extension on the Chrome store is one by the name of ‘Ledger Wallet’ or ‘Ledger Live,’” she wrote."

“It claims to be from Ledger.com ® or Ledger Official ® and for all intents and purposes looks legitimate. It even had over 70 positive 4-5 star reviews, ranging from ‘Its a little difficult to operate’ to ‘once I understood what to do it was easy.’”

"However, the extension then prompted her to enter her wallets’ proprietary seed phrase, which allowed the hackers to take ownership of its private keys and send the XRP to their own wallet."

“The entire process took less than 8 minutes,” she said.

"In [a] post, which was made on March 28, Reddit user ‘Leannekera,’ who also claims to be infected with the coronavirus, wrote that she felt “so embarrassed” after she “watched our xrp transfer from our account to an account that is currently holding over $2.5 million in xrp.”"

"“This is clearly a large operation,” she wrote."

"Fake “Ledger Live” chrome extensions are used to collect user backup passphrases. They are advertised in Google searches and use Google Docs for collecting data. Accounts are being emptied and we have seen more than 200K XRP being stolen the past month alone."

"Since Ledger hardware wallets are used to manage more than 20 types of cryptocurrency accounts, a hacker who manages to steal a Ledger seed phrase could gain access to large amounts of cryptocurrency."

"A fraudulent cryptocurrency wallet masquerading as legitimate Google Chrome extensions may be responsible for a scam operation that may have claimed as much as $2.5 million in XRP, according to a report from a Reddit user who claims to have lost roughly $2,500 in XRP to the scam extension over the weekend."

"I have since reset the ledger, filed a report with Ripple, the FBI and my local Fraud Police. My husband has been ridiculously understanding. He says its just money and right now our focus should be on getting better / staying safe. I feel devastated."

"While the exact Chrome Extension she allegedly used is no longer online, Leannekera said that she had “seen it re-uploaded this morning” at the time of the post. Both of the links that she supplied to the alleged scam wallets were dead ends, seeming to indicate that they had been removed from the Chrome Web Store."

"However, searching the web store revealed that there is a Ledger Wallet extension still live on the platform, and there are a number of reviews that say that it is a scam."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:

* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Ledger Fake Google Chrome Extension
!Date
!Event
!Description
|-
|March 4th, 2020 4:45:00 PM
|First Event
|This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Always check and visit the official website of a service. The majority of funds should be stored offline and not on a live wallet application. When setting up a new wallet or upgrading wallet software, never enter your pass phrase or send any funds without first transferring a smaller amount.

== References ==
[https://twitter.com/Cointelegraph/status/1351695990437376005 @Cointelegraph Twitter] (Feb 25)

[https://cointelegraph.com/news/trezor-crypto-wallet-warns-users-of-doppelgaenger-scam-app-on-google-play Trezor crypto wallet warns users of doppelgänger scam app on Google Play] (Feb 25)

[https://cointelegraph.com/news/22-more-crypto-stealing-google-chrome-extensions-discovered 22 More Crypto-Stealing Google Chrome Extensions Discovered] (Mar 2)

[https://nakedsecurity.sophos.com/2020/05/08/more-crypto-stealing-chrome-extensions-swatted-by-google/ More crypto-stealing Chrome extensions swatted by Google – Naked Security] (Mar 2)

[https://twitter.com/danfinlay/status/1257696177736175617 @danfinlay Twitter] (Mar 2)

[https://www.financemagnates.com/cryptocurrency/news/fake-ledger-chrome-extension-crypto-scam-may-have-stolen-up-to-2-5m/ Fake Ledger Chrome Extension Crypto Scam May Have Stolen Up to $2.5M | Finance Magnates] (Mar 7)

[https://twitter.com/Ledger_Support/status/1235578552457687041 @Ledger_Support Twitter] (Mar 7)

[https://twitter.com/xrpforensics/status/1242513076026556417 @xrpforensics Twitter] (Mar 7)

[https://www.reddit.com/r/CryptoCurrency/comments/fqjyy3/please_beware_14000_xrp_stolen_from_ledger/ Reddit - Dive into anything] (Mar 7)

[https://cointelegraph.com/news/fake-ledger-chrome-extensions-continue-to-steal-crypto-from-victims Fake Ledger Chrome Extensions Continue to Steal Crypto From Victims] (Mar 7)

[https://www.cryptoglobe.com/latest/2020/03/fraudulent-ledger-chrome-scam-may-have-stolen-up-to-2-5-million-in-crypto/ Fraudulent Ledger Chrome Scam May Have Stolen up to $2.5 Million in Crypto | Cryptoglobe] (Mar 7)

[https://tokenpost.com/Fake-Ledger-Chrome-extension-continues-to-steal-millions-of-XRP-from-crypto-users-5374 Fake Ledger Chrome extension continues to steal millions of XRP from crypto users - TokenPost] (Mar 7)

[https://www.reddit.com/r/ledgerwallet/comments/fennfe/fake_ledger_chrome_extensions_solution/ Reddit - Dive into anything] (Mar 7)

[https://www.zdnet.com/article/malicious-chrome-extension-caught-stealing-ledger-wallet-recovery-seeds/ Malicious Chrome extension caught stealing Ledger wallet recovery seeds | ZDNet] (Mar 7)

[https://twitter.com/sniko_/status/1235350687048814592 @sniko_ Twitter] (Mar 7)

[https://whotookmycrypto.com/ledger-wallet-scams/ Nasty Ledger wallet scams. And how to avoid them. - Who Took My Crypto] (Mar 20)

[https://cointelegraph.com/news/ledger-wallet-warns-of-fake-google-chrome-extension-stealing-crypto Ledger Wallet Warns of Fake Google Chrome Extension Stealing Crypto] (Jul 2)

[https://forum.toshitimes.com/t/metamask-got-hacked/12767/3 Metamask got hacked - Moralis Academy Forum] (Aug 22)

[https://medium.com/mycrypto/discovering-fake-browser-extensions-that-target-users-of-ledger-trezor-mew-metamask-and-more-e281a2b80ff9 Discovering Fake Browser Extensions That Target Users Of Ledger Trezor Mew Metamask And More] (Aug 22)

[https://invezz.com/news/2020/03/07/fake-chrome-extension-steals-crypto-from-users-warns-ledger-wallet/ Fake Chrome extension steals crypto from users, warns Ledger Wallet | Invezz] (Aug 22)

[https://medium.com/mycrypto/the-dangers-of-malicious-browser-extensions-ef9c10f0128f The Dangers Of Malicious Browser Extensions] (Aug 22)

[https://support.google.com/chrome/thread/39247659 My money from my ethereum account were stolen after I acceded the account via MEW CX extension. - Google Chrome Community] (Aug 22)

[https://redd.it/fws38m Downloaded new KeepKep Client, my funds were stolen 10 Minutes Later... Who do I vengefully hunt down?! : keepkey] (Aug 22)