SlowMist said Friday that a counterfeit Ledger update page is exploiting a recent device-tampering case, renewing concern over users being directed to update wallets through websites.
Images in SlowMist’s alert show a look-alike Ledger check leading through a device choice to an update prompt. SlowMist advised users to avoid update links on websites and never enter recovery phrases online.
Ledger's anti-phishing guidance says the company does not email users to request firmware or operating-system updates. It also warns users not to type recovery phrases into computers.
In an Oct. 15 response, Ledger said the earlier incident involved authentic devices altered to capture recovery phrases during setup. The company said the devices were modified after they had left its control and later returned to circulation through resellers in Southeast Asia.
Ledger said its chip, operating system and servers were not compromised, describing the case as an attack on distribution. The company did not report a further scheduled step in its response.
