Ledger Phishing Attack On Dutch Users

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Ledger

Ledger reports that a recent phishing campaign was launched targeting Dutch users in their language. This email pretends to be from a law firm working with Ledger, and requests the users to click a malicious link for 2FA verification. While details are not provided, typically links will either try to run a malicious transaction or obtain the user's seed phrase.

About Ledger

"Based in France, Ledger is the largest cryptocurrency hardware wallet company." "Ledger is a hardware cryptocurrency wallet that is used to store, manage, and sell cryptocurrency. The funds held in these wallets are secured using a 24-word recovery phrase and an optional secret passphrase that only the owner knows."

"Ledger offers two products, the Nano S and Nano X, that can store the digital keys used to secure crypto wallets. The devices can be used with a variety of cryptocurrencies, are compatible with numerous apps, and are supposed to offer a safe way to manage crypto without compromising too much on convenience. Ledger says on its website that it has sold 1.5 million products to customers in 165 countries to date."

The Reality

"The scammer is pretending to be working in a law firm in contact with Ledger. They are claiming that We have noticed someone tried to log in on your Ledger account from a location you have never used before. So we have blocked your account and wallet. and asking you to click on a link for a 2FA verification."

"The link provided by the scammers is not legitimate."

What Happened

Dutch Ledger owners received a phishing email which warned them that their account was locked because it was accessed from a new location, and they should follow the instructions to enable "2-factor authentication".

Key Event Timeline - Ledger Phishing Attack On Dutch Users

Date	Event	Description
December 21st, 2020 12:16:31 AM MST	Bleeping Computer Article	BleepingComputer publishes an article on the Ledger data breach, where the physical addresses, email addresses, and names of 272,853 people who purchased a Ledger hardware cryptocurrency wallet have been leaked on a hacker forum. The data was stolen during a June 2020 data breach, and the release of this information poses a significant security risk as it provides threat actors with data that can be used in phishing attacks against Ledger owners. Ledger has advised users to never share their recovery phrase or passphrase with anyone and to be wary of any postal mail or email claiming to be from Ledger. TBD information on update of sim swap attacks from phone numbers.
December 22nd, 2020	CryptoBriefing Article	CryptoBriefing publishes an article on the data breach event that affected more than 270,000 Ledger customers. Ledger's CEO Pascal Gauthier has dismissed any possibility of refunds and instead advised customers to store their seed phrases in a bank vault. In an open message, Gauthier said the company should spend money on improving its security standards instead of issuing refunds. Ledger has also hired a new Chief Information Security Officer, five months after the data breach.
January 19th, 2021 12:54:12 AM MST	Sifted Article	Sifted reports that French cryptocurrency security startup, Ledger, is attempting to recover its reputation after breaches exposed customer data. The company has hired a new security team, introduced new data security procedures and transparency to rectify the issues. The leak, which occurred via two third-party ecommerce partners, could make winning back trust difficult among crypto fans, who tend to be inherently distrustful. The article includes an attack against a Dutch Ledger user. TBD follow more on that Twitter to try to locate a Tweet by the Dutch user about the threats he faces.
March 22nd, 2021 4:17:00 PM MDT	CryptoPotato Article	CryptoPotato publishes an article on Ledger phishing scams in general. Crypto investors with Ledger hardware wallets are being targeted by phishing scams where attackers are posing as Ledger customer support and requesting the 24-word recovery phrase or asking users to reset their PIN number through an embedded link. The phishing emails appear to come from a similar email address to Ledger's official one and encourage users to download Ledger Live. Users are being urged to remain vigilant and to verify any requests from Ledger by checking the website's security certificate and ensuring that the URL matches the official website.
March 1st, 2022	New Phishing Campaign Reported	Ledger reports a new phishing campaign which is targeting Dutch users.

Technical Details

The text of the phishing email was similar to the following.

Hallo Nina,

We hebben gemerkt dat iemand zojuist heeft geprobeerd in te loggen op uw Ledger-account vanaf een locatie die u not niet eerder hebt gebruikt, dus we willen zeker weten dat jij het echt bent.

Uw account en uw wallet zijn tijdelijk geblokkeerd om te voorkomen dat u geld verliest.

Hoe kan ik mijn account herstellen?

1. Klik op Account Herstellen en volg de instructies om uw account te deblokkeren
2. Schakel na het voltooien van het proces Tee-factoranauthenticatie in.

Account Herstellen

Bedankt dat je ons hebt geholpen om je account veilig te houden.

Het Ledger-team

If the message is translated to English, it's a standard attempt to instill fear and prompt the user to verify their wallet.

Hi Nina,

We've noticed that someone just tried to log into your Ledger account from a location you haven't used before, so we want to make sure it's really you.

Your account and your wallet are temporarily blocked to prevent you from losing money.

How can I recover my account?

Click Restore Account and follow the instructions to unblock your account

After completing the process, enable 2-factor authentication.

Restore Account

Thank you for helping us keep your account safe.

The Ledger team

The attackers used the first name of the victim in the emails, which suggests that they may have been pulling this information from a database that may be associated with a prior breach.

Total Amount Lost

It is unknown if anyone fell for the phishing attempt and what funds may have been lost.

Immediate Reactions

Ledger shared an announcement on their website with details of the phishing attack.

Ledger Announcement On Website

Ledger posted an announcement on their website with details of the phishing attack.

DATE

March 1st, 2022

ANATOMY OF THE CAMPAIGN

The scammer is pretending to be working in a law firm in contact with Ledger. They are claiming that We have noticed someone tried to log in on your Ledger account from a location you have never used before. So we have blocked your account and wallet. and asking you to click on a link for a 2FA verification.

The link provided by the scammers is not legitimate.

Language : Dutch

Ultimate Outcome

It is unclear how many users fell for the emails and what information was divulged.

Total Amount Recovered

It is unclear if any funds were lost in this case.

Ongoing Developments

It is unclear if any funds were lost in this case.

Individual Prevention Policies

Knowledgeable users can recognize that the Ledger hardware wallet does not require 2FA verification. The most likely tactic being used here was to request the seed phrase, which should be avoided in all cases.

Private keys can be obtained through seed phrases, mnemonics, private key files, mobile synchronization screens, wallet export features, wallet backups, etc... Never ever send these to anyone else who you do not intend to allow to take all of your money. Attackers will use a wide variety of tactics to convince you like pretending to be your wallet software, pretending they work for the wallet software, or asking you to screen share. Don't fall for them.

This scheme also involved the use of personal information such as first name and email address. Better privacy practices is also one strategy which would reduce the amount of information that scammers would be able to use against you.

Set up separate email addresses for each service, and avoid providing your phone number whenever possible. Any received emails or phone calls must be viewed with scrutiny, especially if unsolicited. Interact with companies only through their official websites and confirm anything with the company directly via multiple official sources, especially if it promises a significant incentive to take an action or threatens access to your funds if an action is not taken. It would be recommended to also establish a network of multiple trusted individuals who use the same services and have a strong level of security knowledge.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

This scheme is only successful due to the limited knowledge of users who may fall victim.

Never take for granted the limited knowledge of users of your service and their tendency to skip past provided information. It is recommended to design a simple tutorial and quiz for new users which explains the basics of seed phrases, strong password generation, secure two-factor authentication, common fraud schemes, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space. This tutorial and quiz should ensure their understanding and be a standard part of the sign-up or download process which is difficult or impossible to skip.

An industry insurance fund is one tool that may be able to assist victims in such cases.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

The primary issue which allows this attack to be successful is a lack of user education.

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

An industry insurance fund could also assist to reduce the losses of affected users in this case.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.