Ledger and Trezor Scam Alert: Fake Letters Target Wallet Users

In 2026, crypto scams are no longer limited to emails, fake airdrops, or malicious apps. Scammers have taken things a step further by sending physical letters to the homes of hardware wallet users, asking them to scan QR codes and “secure” their wallets by entering recovery seed phrases. This is exactly what is now happening to users of Ledger and Trezor

In one case, a letter was falsely signed using the name of Trezor’s CEO, adding more confusion for recipients.

How the Ledger and Trezor Scam Works

The scam follows a simple method.

Inside the letter, users are asked to scan a QR code to secure their wallet. Once scanned, the code redirects to a fake website that closely resembles the official platform.

Next, the website asks users to enter their 12, 20, or 24-word recovery seed phrase. The moment when the user enters the recovery seed phrase, attackers gain full control of the wallet. Later, they immediately transfer out all crypto assets.

Both Ledger & Trezor have confirmed that they never ask for recovery phrases and never contact users asking for sensitive details. Recovery words should only be entered directly on the hardware device itself.

How Scamers Got User’s Data

Shedding more light on the details behind this scam. The security experts believe, and companies believe, that the scam is linked to past data breaches. Ledger suffered a major customer data leak in 2020, and more exposure reportedly occurred in early 2026 through a third-party payment processor.

Trezor also confirmed a breach in January 2024 that exposed the contact information of nearly 66,000 users.

$69 Million Goan In Just 2 Months

According to blockchain security firm SlowMist, since the beginning of this year, the crypto and blockchain ecosystem has already recorded losses of nearly $69 million.

Meanwhile, these losses have come from smart contract vulnerabilities, hacked accounts, supply chain attacks, flash loan exploits, and sandwich attacks, showing that security threats in crypto continue to grow in many different forms.

Users are advised to destroy any suspicious mail immediately and verify updates only through official company websites.

Trust with CoinPedia:

CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.

Investment Disclaimer:

All opinions and insights shared represent the author’s own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.